What are SPF, DKIM and DMARC?

They are three DNS records that authenticate your email. SPF lists who can send for your domain, DKIM cryptographically signs messages, and DMARC tells receivers what to do when SPF or DKIM fail and where to send reports.

Yes. It's completely free with no sign-up. The generator runs fully offline in your browser; the checker makes one DNS-over-HTTPS lookup when you check a domain.

Does the checker send my data anywhere?

Only the domain name you check is sent, and only to a public DNS-over-HTTPS resolver to read public DNS records. The record builders are fully offline — nothing you type there leaves your browser.

Why should DMARC not stay at p=none?

p=none only monitors — it doesn't stop spoofing. Once your reports look clean, move to p=quarantine and then p=reject so receivers actually block unauthenticated mail claiming to be from your domain.

Where does my DKIM key come from?

Your email provider (Google Workspace, Microsoft 365, your ESP, etc.) generates the DKIM key pair and gives you the public key and selector to publish in DNS. This tool helps you format and verify it, but it does not create the key.

SPF, DKIM & DMARC Generator + Checker — Free

SPF, DKIM & DMARC Generator + Checker

This free tool builds SPF and DMARC TXT records, helps you format DKIM, and checks a domain's existing SPF, DKIM and DMARC records, flagging common problems like a missing DMARC or a permissive +all in SPF. The record builders run fully offline in your browser; the checker makes a single DNS-over-HTTPS lookup to read public DNS — no backend and no API key.

Runs in your browser — your data stays on your device, except a DNS-over-HTTPS lookup when you check a domain (only the domain name is sent, to read public DNS records).

SPF record builder

Lists the servers allowed to send mail for your domain.

Includes (one per line — from your providers)

IPv4 addresses (optional, one per line)

IPv6 addresses (optional, one per line)

include a include mx

Policy (how strict)

Your SPF TXT record (host: @)

DMARC record builder

Tells receivers what to do when SPF/DKIM fail, and where to send reports.

Policy (p)

Subdomain policy (sp)

Aggregate reports (rua) email

Forensic reports (ruf) email — optional

pct

aspf

adkim

Your DMARC TXT record (host: _dmarc)

DKIM helper

Your email provider (Google Workspace, Microsoft 365, your ESP) generates the DKIM key pair and gives you a selector and a public key. This tool does not create the key — it formats and verifies it. Paste the public key your provider shows to build the TXT record.

Selector

Your domain

Public key (p=...) from your provider

Host name

selector._domainkey.yourdomain.com

DKIM TXT record value

v=DKIM1; k=rsa; p=YOUR_PUBLIC_KEY

Authentication is step one — reputation is the rest

Correct SPF, DKIM and DMARC let you authenticate, but a cold domain still needs warmup and reputation monitoring to reliably reach the inbox.

Warm up & monitor with Mailreach Affiliate link · how this works

Answers

SPF, DKIM & DMARC — your questions answered

What are SPF, DKIM and DMARC?: They are three DNS records that authenticate your email. SPF lists who can send for your domain, DKIM cryptographically signs messages, and DMARC tells receivers what to do when SPF or DKIM fail and where to send reports.

Is this tool free?: Yes. It's completely free with no sign-up. The generator runs fully offline in your browser; the checker makes one DNS-over-HTTPS lookup when you check a domain.

Does the checker send my data anywhere?: Only the domain name you check is sent, and only to a public DNS-over-HTTPS resolver to read public DNS records. The record builders are fully offline — nothing you type there leaves your browser.

Why should DMARC not stay at p=none?: p=none only monitors — it doesn't stop spoofing. Once your reports look clean, move to p=quarantine and then p=reject so receivers actually block unauthenticated mail claiming to be from your domain.

Where does my DKIM key come from?: Your email provider (Google Workspace, Microsoft 365, your ESP, etc.) generates the DKIM key pair and gives you the public key and selector to publish in DNS. This tool helps you format and verify it, but it does not create the key.

Related email tools

Website services

Need a website that brings customers?

We build websites for restaurants, hotels, gyms and local businesses. Check your current site free, or ask for a quote.

Free website check Get a free quote

Software we recommend

Mailreach

Email warm-up and inbox placement tests.

Visit Mailreach Read our review

Affiliate link: we may earn a commission at no extra cost to you.

Did this tool help you check your email setup?

MarketingToolsProHub keeps this tool free for everyone. If it helped you save time or get your work done, you can support its continued development.

Support Free Tools

Support is entirely voluntary. Every free tool stays free either way.