SPF Record Generator, DKIM and DMARC generator for your domain

Three DNS records that let receiving mail servers check whether an email really comes from your domain. SPF lists the servers allowed to send, DKIM signs each email with a key, and DMARC determines what happens to emails that fail both checks. Gmail and Yahoo require all three for high-volume senders.

On the SPF tab, select your mailbox providers and sending services, enable mx or a for your own server, and enter any additional IPs or hostnames. The generator builds a record that starts with v=spf1 and ends with ~all, -all or ?all. A domain can have only one SPF record: if you already have one, load and extend it with “Load existing records” instead of creating a second.

The templates cover 13 providers. For any other provider, enter its SPF hostname from the provider's instructions in the “Additional IPs and services” field. The generator turns it into an include. IP addresses become ip4 or ip6. In the DKIM tab, select “Other provider” and enter the selector and value.

The SPF standard (RFC 7208) sets this limit: include, a, mx, ptr, exists and redirect each trigger a lookup, and an include can contain more. From the eleventh lookup onward, mail servers treat the record as a permerror, and SPF fails. The generator counts top-level lookups. If you’re nearing the limit, replace includes with fixed ip4 and ip6 entries.

On the DKIM tab, select “Generate key”, enter a selector such as mail, choose 2048 or 1024 bits, and click “Generate key pair”. Add the public part as a TXT record at selector._domainkey. Download the private key and put it on your server. The tool also shows the corresponding OpenDKIM KeyTable and SigningTable lines. The key pair is generated only in your browser.

Your provider generates the key: for Google Workspace, in the Admin console under Gmail > Authenticate email; for Microsoft 365, in the Defender portal under Email authentication. Google provides a TXT value, while Microsoft provides two CNAME targets for selector1 and selector2. Select the provider in the DKIM tab and enter the values.

Start with p=none and a reporting address (rua) to see who's sending email on your behalf for a few weeks. Once all legitimate senders pass SPF or DKIM, switch to p=quarantine (spam folder) and then p=reject (rejected). Only these two policies protect against spoofed senders. If reports go to another domain, the generator shows the TXT record that domain needs to authorize receipt.

Yes. You can generate records, create DKIM keys and copy them without signing in. You only need to sign in to add records directly to a domain whose DNS is managed by ZAP-Hosting. Before you do, the tool shows which records are new and which will replace an existing SPF, DKIM or DMARC record. You can then check whether everything is published correctly for free in the Email DNS Health Checker. Go to Email DNS Health Checker