Generate your SPF, DKIM and DMARC records

What each record actually does

SPF is a public list of the servers allowed to send email using your domain. A receiving server looks it up and checks whether the message came from one of them. It is a single TXT record on your root domain, and there must only ever be one — two SPF records is an automatic failure, which is a surprisingly common way for a domain to break its own authentication.

DKIM attaches a cryptographic signature to every message, which the receiver verifies against a public key published in your DNS. Where SPF proves the message came from an approved server, DKIM proves the content was not altered in transit. DKIM keys are generated per sending account, which is why this tool cannot produce yours — you copy it from your sending platform after adding the domain.

DMARC ties the two together and tells receivers what to do when a check fails: nothing (p=none), send to spam (p=quarantine), or refuse outright (p=reject). It also asks receivers to send you reports about mail claiming to be from your domain — which is the part that makes the whole system usable, because it shows you who is sending as you.

Start at p=none. This is not optional advice.

The most damaging mistake in email authentication is publishing p=reject immediately because it sounds like the secure choice. It is the destination, not the starting point. Most organisations have more things sending as their domain than they realise — the billing system, the helpdesk, a recruiter tool, a form plugin on the marketing site, an agency sending on their behalf. Enforce before you have found them all and that mail is refused outright, silently, with no bounce anyone will think to look for.

The sequence that works: publish p=none with a report address, read the aggregate reports for two to four weeks, fix or authorise every legitimate sender you find, move to p=quarantine, watch for a further few weeks, then move to p=reject. It takes about six weeks of mostly waiting, and it is the difference between protecting your domain and disabling it.

The SPF lookup limit that catches people out

SPF allows a maximum of ten DNS lookups when evaluating a record. Every include: costs at least one, and several major providers chain to further includes internally, so a record with six or seven includes can quietly exceed the limit. When it does, the record returns a permanent error and most receivers treat that as a failure — meaning an elaborate SPF record can authenticate worse than a simple one. If you are close to the limit, remove providers you no longer use before adding new ones.

After the records are published

DNS changes typically propagate within a few hours, though the published TTL can make it longer. Once they are live, send yourself a test message and check the headers for spf=pass and dkim=pass. If you want the full walkthrough with screenshots for the major DNS hosts, the step-by-step setup guide covers it, and the Gmail and Yahoo requirements page covers what else those two now expect from bulk senders.