DKIM, SPF & DMARC DNS Builder
Secure your domain's email deliverability by generating perfect SPF, DKIM, and DMARC records instantly. Prevents your emails from landing in spam folders and protects your domain from spoofing.
How ZeroData protects your privacy
- ✓ No Uploads: Processing happens entirely via client-side JavaScript.
- ✓ No Storage: We do not have a database. We physically cannot save your data.
- ✓ No Tracking: We don't log what you process or track your inputs.
- ✓ Verifiable: Check your DevTools Network tab. You will see 0 outbound requests.
Why Email Authentication Matters
Major email providers like Gmail and Yahoo now enforce strict authentication requirements. If your domain lacks proper SPF, DKIM, and DMARC records, your emails are highly likely to be rejected or routed to the spam folder. If you are compiling lists for outreach, you can use our Email Extractor to gather contacts before verifying their deliverability.
Configuring these records manually can be error-prone. A common mistake is creating multiple SPF records instead of combining them, which completely breaks email deliverability. DKIM records often involve base64-encoded strings, which you can verify using our Base64 Encoder. Our builder ensures your syntax is 100% correct and compliant with RFC standards. Additionally, it's vital to ensure your mail servers' encryption is valid; you can inspect certificates with our Certificate Decoder.
The DMARC Journey
When implementing DMARC, it's recommended to start with a policy of p=none. This tells receivers to deliver the emails normally but send you reports about authentication failures. If you are parsing these XML DMARC reports programmatically, our Regex Tester can help you build the right extraction expressions. Once you're confident all your legitimate sending sources are authenticated, you can upgrade your policy to p=quarantine (send failures to spam) and eventually p=reject (drop failures entirely).
For a complete deep dive into securing your email infrastructure, read our Ultimate Email Deliverability & DNS Guide to master everything from sender reputation to advanced DNS configurations.
How to Use the DKIM, SPF & DMARC DNS Builder
- Enter your domain name (e.g., example.com).
- Select all the email providers you use to send emails from this domain.
- Set your DMARC policy (start with 'None' for monitoring, then move to 'Quarantine' or 'Reject').
- Optionally, provide an email address to receive DMARC reports.
- Copy the generated DNS records and add them to your domain registrar (e.g., Cloudflare, GoDaddy, Namecheap).
Common Use Cases
- Setting up Google Workspace or Microsoft 365 for a new domain.
- Adding third-party senders like Mailgun or SendGrid without breaking existing SPF records.
- Implementing DMARC to prevent domain spoofing and phishing attacks.
- Fixing 'email went to spam' issues caused by missing or invalid DNS records.
- Consolidating multiple SPF include statements into a single valid TXT record.
Frequently Asked Questions
What is SPF?
SPF (Sender Policy Framework) is a DNS record that lists the IP addresses and domains authorized to send emails on behalf of your domain. It prevents spammers from sending unauthorized emails from your domain.
What is DKIM?
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your emails. When the receiving server gets your email, it checks the signature against your DNS DKIM record to verify the email wasn't tampered with in transit.
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together. It tells the receiving server what to do if an email fails SPF or DKIM checks (e.g., do nothing, quarantine to spam, or reject completely).
Can I have multiple SPF records?
No, a domain must have exactly one SPF record. If you use multiple services (like Google Workspace and Mailgun), you must combine them into a single record using multiple 'include' mechanisms. Our tool does this for you automatically.
Where do I add these records?
You need to add these as TXT or CNAME records in your domain's DNS settings. This is typically managed where you bought your domain (e.g., GoDaddy, Namecheap, Route53) or your DNS provider (e.g., Cloudflare).
Related Tools
HTTP Header Analyzer
Parse and analyze HTTP response headers for security issues. Check CSP, HSTS, and more — locally in your browser.
Nginx Config Generator
Generate Nginx server block configurations visually. Reverse proxy, SSL, gzip, and security headers — 100% browser-based.
Security Headers Builder
Generate HTTP security response headers for Nginx, Apache, Express, Caddy, and Cloudflare Workers.