SPF & DMARC builder
Paste the TXT record your host gave you and find out what it actually says. Or build a new one without memorising the syntax.
Runs in your browser. Nothing you paste or drop here is uploaded anywhere.
No DNS lookups here, on purpose: your domain never leaves the browser. Fetch the record yourself with dig TXT example.com +short, dig TXT _dmarc.example.com +short or nslookup -type=TXT example.com.
1 record · 1 warning
v=spf1 +a +mx +ip4:203.0.113.10 include:_spf.google.com ptr ~all
| # | Term | What it means | If it matches | Lookups |
|---|---|---|---|---|
| 1 | v=spf1 | Marks this TXT record as SPF, version 1. Must come first. | — | |
| 2 | +a | Mail from the IP addresses in this domain’s A/AAAA records: usually your web server. | Passallowed | 1 |
| 3 | +mx | Mail from this domain’s MX servers, the ones that receive your mail. | Passallowed | 1 |
| 4 | +ip4:203.0.113.10 | Mail from the IP address 203.0.113.10. | Passallowed | — |
| 5 | include:_spf.google.com | Google Workspace: whatever the SPF record of _spf.google.com allows. | Passallowed | 1 |
| 6 | ptr | Reverse-DNS check: passes if the sender’s IP points back to a name under this domain. | Passallowed | 1 |
| 7 | ~all | Everything that didn’t match anything above. | SoftFailaccept, flag it | — |
- !Warning
ptris deprecated by RFC 7208: slow, and many receivers skip it. List the IPs, or useaormx. - iNote
~all: mail from anywhere else is a soft fail, usually accepted and flagged. A fine start; switch to-allonce the list is complete. - iNote
+is the default qualifier, so+aandamean the same thing. - iNoteEach
includeandredirectbrings its own lookups, and they count too. This tool doesn’t query DNS, on purpose, so it can’t count those: check the included records yourself.
IPs become ip4:/ip6:, domains become include:. Separate with spaces or commas.
-all once the list is complete, ~all while you’re still checking.
- Host
@example.com- Type
TXT- Value
v=spf1 a mx include:_spf.google.com ~all- Zone file
example.com. 3600 IN TXT "v=spf1 a mx include:_spf.google.com ~all"
Deliver as usual and send reports. Start here.
Send failing mail to spam.
Refuse failing mail. The end goal.
mailto: is added for you. Several addresses: separate with commas.
Alignment and failure reports
Roll out in steps: none with reports for a few weeks, then quarantine, then reject.
- Host
_dmarc_dmarc.example.com- Type
TXT- Value
v=DMARC1; p=none; rua=mailto:dmarc@example.com- Zone file
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
How to use it
- Paste a TXT value into Explain: the bare record, the quoted version, or whole lines from
digor a zone file. - Read the table top to bottom. SPF checks terms left to right and stops at the first match, so the order matters.
- Fix anything marked Problem first, then the warnings.
- Starting from scratch? Open Build SPF or Build DMARC, pick what applies and copy the host and value into your DNS panel.
- Check the live record with
dig TXT example.com +shortanddig TXT _dmarc.example.com +short(Windows:nslookup -type=TXT example.com).
What it does
SPF, DKIM and DMARC are TXT records in your DNS. SPF lists the servers allowed to send mail for your domain. DKIM publishes the public key that checks your mail’s signature. DMARC tells receivers what to do when those checks fail, and where to send reports. The longer version, with a toy to play with, is in SPF, DKIM and DMARC: what are they?
The explainer follows RFC 7208 for SPF and RFC 7489 for DMARC. It flags what makes receivers give up on a record: a second SPF record, more than 10 DNS lookups, an unknown mechanism, a missing p=. And what’s legal but unwise: +all, ptr, p=none with nowhere to send the reports. Paste a DKIM key record (v=DKIM1) and it explains that too.
It doesn’t query DNS, on purpose. A lookup would hand your domain to a resolver, and nothing you type here leaves the browser. That’s also its limit: it counts the lookups in the record you paste, but not the ones inside each include:. If you’re close to 10, fetch those records with dig and paste them too.
Roll DMARC out in stages. Start with p=none and a rua address, read the reports for two to four weeks, and add the senders you forgot to SPF and DKIM. Then p=quarantine (with pct=25 if you’re nervous), and finally p=reject.
Questions
Should I use ~all or -all?
Use ~all while you’re still finding all your senders, and -all once the list is complete. Once DMARC is published, most receivers act on the DMARC policy rather than the bare SPF result, so the difference is smaller than it looks. Never use +all: it lets anyone send as you.
What does p=none do?
Nothing to your mail: receivers deliver it as usual and send you reports about what passed and what failed. It’s the safe first step, as long as you add rua=mailto:…. Without a report address, you’re monitoring nothing.
Can I have two SPF records?
No. A domain must publish exactly one TXT record that starts with v=spf1. With two, receivers return permerror and SPF fails for every message. Merge them: one v=spf1, all the include: and ip4: terms, one all at the end.
What is the SPF 10 DNS lookup limit?
Receivers give up after 10 DNS lookups while checking one SPF record and return permerror. include, a, mx, ptr, exists and redirect cost one each, and so does every one of those inside the records you include. ip4, ip6 and all are free. Drop services you no longer use, or replace an include with the IP ranges behind it.
Why does DMARC fail when SPF passes?
Because DMARC also wants alignment: the domain that passed has to match the domain in the From address people see. SPF checks the bounce address (Return-Path), and newsletter and CRM services often put their own domain there, so SPF passes for their domain, not yours. DMARC passes when SPF or DKIM passes and aligns, so the usual fix is DKIM signed with your domain (most services give you CNAME or TXT records for it) or a custom return-path on a subdomain of yours. Relaxed alignment, the default, accepts any subdomain of your domain; aspf=s and adkim=s demand an exact match.