Generate and check SPF and DMARC records in your browser, without querying DNS.
Enter a CIDR to get network, broadcast, usable hosts and masks for IPv4 and IPv6.
Open →Look up RDAP registry data and reverse DNS for an IPv4/IPv6 address, domain or URL.
Open →Shows your public IP, network details and approximate location, with a WebRTC leak check.
Open →No comments yet. Be the first!
The SPF & DMARC Generator builds and checks e-mail authentication records following RFC 7208 (SPF) and RFC 9989 (DMARC). For SPF you can tick common sending services' includes, add IPs, set the ending rule and estimate the DNS lookup count (limit 10); for DMARC you set policies p/sp/np, report mailboxes, failure-report options and alignment modes. You can also paste an existing record for an offline syntax check. The tool only handles text: it never queries DNS and cannot prove that DNS is configured correctly.
No. It only builds and checks the record TEXT in your browser and never queries DNS, so it cannot prove that a record is published or live. After publishing, confirm with a DNS lookup tool and check authentication results with a real test message.
Under RFC 7208 an SPF evaluation may involve at most 10 terms that trigger DNS queries (include, a, mx, ptr, exists and redirect), and terms nested inside an include count too. ip4, ip6 and all do not count. Beyond the limit receivers return permerror, which means SPF fails.
For the built-in common senders the tool uses nested lookup counts measured in public DNS on 2026-10-20; for an include you type yourself the nested count is unknown, so it is counted as 1 with a notice. Providers can change records at any time, so confirm with a DNS-based SPF checker before publishing.
~all (soft fail) says unlisted sources are probably unauthorized but should be accepted and marked; it suits the start, before every sender is confirmed. -all (hard fail) rejects them outright. Google's guidance recommends ~all, while Microsoft recommends -all once DKIM and DMARC are also in place. Never use +all, which lets anyone send as your domain.
RFC 9989 (DMARCbis) defines v, p, sp, np, adkim, aspf, fo, rua, ruf, psd and t. The RFC 7489 tags pct, rf and ri were removed, with t (the testing flag; t=y roughly replaces the common pct=0 use) taking over the usual use case. This tool does not write pct by default; it is added only if you switch it on under "Advanced and compatibility options".
Start with p=none and an rua address, and collect aggregate reports for at least a month to find every legitimate sender. Align each sender's SPF or DKIM with your From domain, then move to p=quarantine and watch again (use t=y first if unsure). Switch to p=reject only when legitimate mail is no longer affected. p=reject can disturb mailing lists and forwarding, so read the reports first.
When an rua or ruf mailbox is outside your domain, that other domain must publish a TXT record with the value v=DMARC1; at "your-domain._report._dmarc.other-domain", otherwise most receivers will not send reports; the tool shows the exact host name. Postmark's own documentation says you do not need to add it to your SPF, so it is not in the presets; every listed service's include value comes from its official documentation.
v=spf1 include:_spf.google.com ~all
| Type | DNS host name | Value |
|---|---|---|
| TXT | @ | v=spf1 include:_spf.google.com ~all |
