SPF & DMARC DNS Record Generator

Build RFC-compliant SPF and DMARC TXT records for email authentication, track your RFC 7208 10-DNS-lookup budget, and prevent domain spoofing.

Domain Name

SPF Enforcement Policy

Authorized IPv4 / IPv6 CIDRs (space/comma-separated)

Extra SPF Includes (optional)

Common Email Providers (check all that send mail for your domain)

Google Workspace Microsoft 365 Amazon SES SendGrid Mailgun

DMARC Policy (p=)

Aggregate Report Email (rua=)

Generated DNS Zone Records

Record Type	Host / Name	TXT Value

Understanding SPF, DKIM, DMARC & the RFC 7208 10-Lookup Limit

Sender Policy Framework (SPF, RFC 7208) publishes an authoritative list of mail servers permitted to send email on behalf of your domain via a root DNS TXT record starting with v=spf1. Receiving MTAs compare the connecting server's IP against your ip4, ip6, and third-party include: mechanisms before applying your trailing ~all (SoftFail) or -all (Fail) qualifier.

A critical operational pitfall in SPF engineering is the RFC 7208 10-DNS-lookup ceiling. Every include, a, mx, or redirect mechanism—including nested includes inside third-party providers—counts toward a strict maximum of 10 DNS queries. Exceeding 10 lookups causes receiving servers to abort evaluation with PermError, breaking deliverability. Direct ip4: and ip6: CIDR entries consume zero DNS lookups.

Domain-based Message Authentication, Reporting, and Conformance (DMARC, RFC 7489) ties SPF and cryptographic DKIM signatures to the visible From: header domain. Major mailbox providers (including Gmail and Yahoo) require bulk senders to publish valid SPF, DKIM, and a _dmarc TXT record with aggregate reporting (rua=mailto:...) before gradually stepping enforcement from p=none to p=quarantine and p=reject.