DKIM, SPF & DMARC DNS Builder

Quick Solution

To set up basic email authentication, you need three DNS TXT records: SPF, DKIM, and DMARC. A basic SPF record looks like v=spf1 mx include:_spf.google.com ~all. A basic DMARC policy looks like v=DMARC1; p=quarantine; rua=mailto:[email protected];. Add these to your domain's DNS settings.

When Should I Use This?

Use the Email DNS generator to correctly configure authentication records and improve email deliverability.

• Preventing your application's transactional emails (from SendGrid, Postmark, AWS SES) from landing in the spam folder.
• Complying with the strict Google and Yahoo sender requirements implemented in 2024, which mandate DMARC alignment.
• Stopping bad actors from spoofing your domain name in phishing campaigns by enforcing a strict p=reject DMARC policy.

Why Email Authentication Matters

Major email providers like Gmail, Yahoo, and Outlook now enforce strict authentication requirements for all inbound mail. If your domain lacks proper SPF, DKIM, and DMARC records, your legitimate emails are highly likely to be rejected outright or quietly routed to the recipient's spam folder. Email deliverability is no longer just about sending good content; it requires a technically sound DNS foundation. If you are compiling lists for outreach, you can use our Email Extractor to gather contacts before setting up these crucial deliverability protocols.

Configuring these DNS records manually can be exceptionally error-prone. A common, catastrophic mistake is creating multiple SPF records for a single domain instead of combining them into one string with multiple 'include' statements. Having more than one SPF record completely breaks email deliverability. DKIM records often involve complex base64-encoded public keys, which you can decode and verify using our Base64 Encoder. Our email DNS builder eliminates these risks by ensuring your generated syntax is 100% correct and strictly compliant with RFC standards. Additionally, it's vital to ensure your mail servers' encryption is valid; you can inspect certificates securely with our Certificate Decoder.

Why Privacy Matters

When configuring domain infrastructure, exposing your backend email routing and third-party vendor lists to external tools can represent a security concern. Many online DNS builders transmit your domain name and selected providers to a backend server for tracking or lead generation purposes.

We believe in uncompromising security. Our generator is 100% private — files never leave your browser. All SPF, DKIM, and DMARC records are constructed locally on your machine using client-side logic. Your domain name, provider selections, and reporting email addresses are never transmitted to our servers or logged in any database. You get precise, enterprise-grade DNS records with absolute data sovereignty.

The DMARC Implementation Journey

Implementing DMARC is not a one-step process; it is a staged rollout designed to prevent you from accidentally blocking your own legitimate mail. We strongly recommend starting with a monitoring policy of p=none. This instruction tells receiving mail servers to deliver emails normally, even if they fail authentication, but to send you aggregate reports detailing those failures.

By reviewing these reports, you can identify third-party tools (like marketing platforms or CRM software) that are sending email on your behalf without proper DKIM signatures. If you are parsing these raw XML DMARC reports programmatically in your backend, our Regex Tester can help you build the precise extraction expressions needed to surface errors. Once you have confidently authenticated all legitimate sending sources, you should upgrade your policy to p=quarantine (forcing failures to the spam folder) and eventually reach the gold standard of p=reject (instructing receivers to drop failed emails entirely, eliminating domain spoofing).

Browser Compatibility

Our DNS Builder is designed as a lightweight, fast, and entirely offline-capable web application. Because it relies purely on modern JavaScript without backend dependencies, it offers flawless performance across all environments.

• Google Chrome & Edge: Fully supported, allowing quick copy-pasting directly into your Cloudflare or Route53 dashboards.
• Mozilla Firefox: Fully compatible, aligning perfectly with Firefox's pro-privacy stance.
• Safari (macOS & iOS): Seamlessly supported. Generate records on your iPad or iPhone while managing infrastructure remotely.
• Zero Latency: Because no server round-trips are required, the records update instantly as you check or uncheck provider boxes.

Troubleshooting Email Deliverability Errors

If your emails are still landing in the spam folder, check these common DNS configuration issues:

• "Too many DNS lookups" (PermError): Your combined SPF record exceeds the 10-lookup limit. If you use Google, Microsoft, Mailgun, and Zendesk simultaneously, you likely hit this limit. You must audit your vendors and remove legacy ones.
• Multiple SPF Records: Using tools like dig txt yourdomain.com, verify you only have exactly ONE record starting with v=spf1. Multiple records cause instant failure.
• DKIM Key Truncation: Some older DNS providers (like GoDaddy) enforce a 255-character limit on TXT records. Modern 2048-bit DKIM keys are longer than this. You must split the key into two quoted strings within the same TXT record, or use CNAME delegation.

Security Best Practices for DMARC

• The Phased Rollout: Never jump straight to p=reject. Start at p=none for 30 days to collect DMARC XML reports. Analyze these reports to ensure all your legitimate software is signing emails properly before enforcing quarantines.
• SPF Hard Fail vs Soft Fail: End your SPF record with ~all (soft fail) when you are using DMARC. The strict -all (hard fail) can break legitimate email forwarding because the forwarding server's IP won't be in your SPF record.
• Secure DKIM Key Storage: Keep the private half of your DKIM keys highly secured inside your email provider's vault. If a malicious actor steals your private DKIM key, they can send cryptographically authenticated spoofed emails on your behalf.

Command Line (CLI) Verification

You can instantly check your live DNS records from any Linux, macOS, or Windows terminal using the dig or nslookup commands:

# Verify your SPF record
dig txt yourdomain.com +short | grep "v=spf1"

# Verify your DMARC record
dig txt _dmarc.yourdomain.com +short

# Verify a specific DKIM selector (e.g., 'google')
dig txt google._domainkey.yourdomain.com +short