DNS Record Generator

What This Generator Builds

Three DNS records decide whether receiving servers trust email from your domain. SPF lists the servers allowed to send for you. DKIM publishes a public key so receivers can verify each message's signature. DMARC tells receivers what to do when a message fails and where to send reports. This tool builds the SPF and DMARC records for you, lays out a dated DMARC rollout, and shows exactly where each provider's DKIM record goes.

How The SPF Record Is Built

A domain may publish only one SPF record. When a business adds Google Workspace, then a newsletter tool, then an app sender, the usual mistake is a second v=spf1 record for each one. Receivers treat two SPF records as a permanent error and SPF fails for everything. The generator merges every sender you tick into a single record:

1. Your own server IPs go first as ip4: and ip6: mechanisms. They cost no DNS lookups.
2. Each provider adds its published include, such as include:_spf.google.com for Google Workspace or include:spf.protection.outlook.com for Microsoft 365.
3. Any custom includes you paste are added, with duplicates removed.
4. The record ends with ~all or -all, your choice.

The 10 Lookup Limit

RFC 7208 caps SPF at 10 DNS lookups. Every include costs one, and so does every include nested inside the provider's own record. Google Workspace costs four on its own, because _spf.google.com includes three more records. The generator counts what it can know for certain and labels the total "at least", because providers change their nested records without notice. After you publish, run the Email Deliverability Checker on the domain to get the live recursive count.

Providers That Live On A Subdomain

Some services do not belong in your root SPF at all. Resend verifies a send subdomain with its own SPF and MX records. Amazon SES checks SPF on a custom MAIL FROM subdomain, so include:amazonses.com goes on that subdomain, not the root. The generator outputs those records separately. Mailgun also recommends a sending subdomain, and HubSpot issues an account specific include you paste into the custom field.

DKIM: Why There Is No Record To Copy

A DKIM key pair is generated by the service that signs your mail. The private key stays with them and the public key goes in your DNS. No outside tool can generate it for you. What is predictable is where it goes: selector._domainkey.yourdomain.com. Google uses the selector google, Microsoft 365 uses selector1 and selector2 as CNAMEs, SendGrid uses s1 and s2, Mailchimp uses k2 and k3. The table under the result lists the host, record type and the screen in each dashboard where the value lives.

DKIM matters more than most people think. On third party platforms SPF often checks the platform's own bounce domain, not yours, so it cannot align with your From address. A DKIM signature on your domain is usually what makes DMARC pass.

The DMARC Rollout Schedule

Publishing p=reject on day one is how businesses block their own invoices. The safe route is staged, and the generator dates every step from your start date:

• Monitoring. p=none with a rua address for the number of weeks you choose. Reports arrive daily from Google, Microsoft, Yahoo and others, listing every server sending as your domain and whether it passed.
• Quarantine. p=quarantine at pct=10, then 25, 50 and 100. Failing mail goes to spam for that share of messages.
• Reject. p=reject at 25, 50 and finally 100. Under RFC 7489, the share not covered by pct gets the next lower policy, so rejected mail that falls outside the percentage is quarantined instead.

The dates are a plan, not a timer. Advance a step only when the reports show every legitimate sender passing. The DMARC revision under way at the IETF replaces pct with a simpler testing flag. Receivers honour pct today, and the schedule still works if you change the tag later.

Mistakes To Avoid

• Forgetting a sender. The booking system, the invoicing tool and the website contact form all send mail. Each needs to be in SPF or signing with DKIM, ideally both.
• Using +all. It authorises every server on the internet.
• Leaving DMARC on p=none forever. It reports, but it stops nothing.
• Sending reports to an inbox nobody reads. Use a shared mailbox or a report service that summarises them.

For Agencies

Build the records for each client in a few minutes, share the result link for approval, then download the full set for whoever manages their DNS. Wise Media starts every email engagement this way, because no campaign result is reliable until authentication is right.