Will this stop people spoofing my domain straight away?

Not on its own. The records only take effect once you publish them at your DNS host, and DMARC only protects you when its policy is set to quarantine or reject. On the default none setting it monitors and reports but blocks nothing. It also cannot stop lookalike domains, only forgery of your exact domain.

What is the difference between -all and ~all on my SPF record?

Hard fail (-all) tells receivers to reject any mail from a server not on your list. Soft fail (~all) tells them to accept it but mark it suspicious. Start with soft fail while you confirm every legitimate sender is listed, then move to hard fail once you are sure, so you do not block your own mail.

Why can't the tool generate my DKIM key?

Because the key is created by your email provider and half of it, the private key, never leaves their systems. We would be handing you an invalid record. Generate the DKIM key in Microsoft 365, Google Workspace or your sending platform, then publish the value they give you at the selector they specify.

Where do I put these records?

All three are DNS TXT records at your domain host. SPF goes on your root domain, DMARC goes on the host _dmarc.yourdomain.co.uk, and DKIM goes on a selector host like selector._domainkey.yourdomain.co.uk. The tool labels each one with its exact host name so you know which box to paste it into.

I already have an SPF record. Can I have a second one?

No. A domain must have exactly one SPF record. If you publish a second, most receivers treat both as invalid and your authentication breaks. You need to merge the new senders into your existing record instead. This tool cannot see your current record, so check before you publish.

Free tool

Build the records that stop your domain being spoofed

You publish three DNS records: SPF says which servers may send as you, DKIM signs your mail so it cannot be tampered with, and DMARC tells receivers what to do when a message fails both. This tool builds all three from your answers, ready to copy into your DNS host. A member of our team is a certified ISO 27001 Lead Auditor and ISO 42001 Auditor, so the defaults lean cautious.

Your domain

Who sends email as you

Your own sending IPs (optional)

SPF strictness

DMARC policy

Report address (rua)

DKIM selector (from your provider)

Three TXT records for your DNS host

; SPF  (TXT record on yourdomain.co.uk)
v=spf1 ~all

; DMARC  (TXT record on _dmarc.yourdomain.co.uk)
v=DMARC1; p=none; pct=100

; DKIM  (TXT record on selector1._domainkey.yourdomain.co.uk)
; The value below is generated by your email provider, not here.
; Create the DKIM key in your provider, then paste its value:
v=DKIM1; k=rsa; p=<public-key-from-your-provider>

Nothing is protected until you publish these, and a wrong record can block your own mail. We cannot see what you already have. Roll DMARC out from none, confirm your senders before hard fail, and verify against your live setup first.

Runs in your browser. Nothing you type is sent to us or stored.

Generating a record is not deploying it, and a wrong one can break your email

This tool writes text. It does not touch your DNS, send anything to a server, or check what you already have published. Nothing changes until you paste these records into your DNS host yourself. That matters because email records are unforgiving. An SPF record that ends in -all while missing one of your real senders will cause that sender's mail to be rejected. Too many SPF lookups breaks the whole record. A DMARC policy set to reject before your reports are clean can bin invoices and enquiries without a trace. We cannot see your current setup, so we cannot tell you whether these records complete your configuration or conflict with it. Treat the output as a draft to check against your live senders, roll DMARC out gradually from none, and if your mail is business critical, have someone verify the change before you enforce it.

What these three records actually do

They are the email world's answer to a simple question: is this message really from you? SPF lists the servers allowed to send using your domain. DKIM adds a cryptographic signature that proves the message was not altered in transit. DMARC ties the two together and tells receiving servers what to do with mail that fails, and where to send you reports. Together they make impersonation far harder.

Why you start DMARC on “none”

A DMARC policy has three settings: none, quarantine and reject. This tool defaults you to p=none, which asks receivers to enforce nothing yet but to send you reports. That is deliberate. Those reports show you every service sending as your domain, including ones you forgot about, like your invoicing tool or newsletter platform. Only once the reports are clean do you tighten to quarantine, then reject. Jumping straight to reject can silently bin your own legitimate mail.

The SPF ten-lookup trap

SPF has a hard limit: a receiver will only follow ten DNS lookups before it gives up and treats your record as broken. Every include for a service like Microsoft 365, Google Workspace or a mail platform counts toward that ten. Stack up too many providers and your perfectly legitimate mail starts failing. This tool counts your includes and warns you as you approach the limit, but it cannot flatten or merge them for you.

DKIM comes from your email provider, not from us

SPF and DMARC are records you can write by hand. DKIM is different. The public key in a DKIM record is generated by whoever sends your mail, Microsoft 365, Google Workspace, Mailchimp and so on, paired with a private key only they hold. We cannot invent that key. This tool shows you the exact record shape and the selector pattern, then points you to the setting in your provider where the real value is generated.

Check before and after

Once it is published, confirm it with the DMARC checker

Questions

Will this stop people spoofing my domain straight away?: Not on its own. The records only take effect once you publish them at your DNS host, and DMARC only protects you when its policy is set to quarantine or reject. On the default none setting it monitors and reports but blocks nothing. It also cannot stop lookalike domains, only forgery of your exact domain.
What is the difference between -all and ~all on my SPF record?: Hard fail (-all) tells receivers to reject any mail from a server not on your list. Soft fail (~all) tells them to accept it but mark it suspicious. Start with soft fail while you confirm every legitimate sender is listed, then move to hard fail once you are sure, so you do not block your own mail.
Why can't the tool generate my DKIM key?: Because the key is created by your email provider and half of it, the private key, never leaves their systems. We would be handing you an invalid record. Generate the DKIM key in Microsoft 365, Google Workspace or your sending platform, then publish the value they give you at the selector they specify.
Where do I put these records?: All three are DNS TXT records at your domain host. SPF goes on your root domain, DMARC goes on the host _dmarc.yourdomain.co.uk, and DKIM goes on a selector host like selector._domainkey.yourdomain.co.uk. The tool labels each one with its exact host name so you know which box to paste it into.
I already have an SPF record. Can I have a second one?: No. A domain must have exactly one SPF record. If you publish a second, most receivers treat both as invalid and your authentication breaks. You need to merge the new senders into your existing record instead. This tool cannot see your current record, so check before you publish.