SPF AND DMARC GENERATOR
Build an SPF and DMARC record that will not silently break
Pick your sending providers, get a valid record, and watch the DNS lookup counter. SPF permanently fails past 10 lookups, and most people never find out. No DNS queries are made and nothing is stored.
Updated July 2026
SPF lists which servers may send for your domain and must stay within 10 DNS lookups. DMARC tells receivers what to do when a message fails, and needs a reporting address. Start DMARC at p=none, read the reports, then move to quarantine and reject. Publish both as TXT records.
SPF record
Every mechanism that resolves a name costs a DNS lookup. The limit is 10 for the whole record, including everything your includes include.
Used to build the DNS host names. Nothing is looked up or sent anywhere.
Comma or space separated. Each one costs at least 1 lookup, usually more.
ip4 and ip6 mechanisms cost zero lookups. Prefer these when you are near the limit.
A cold email domain should not sit on ?all. Move to -all once the record is proven.
DMARC record
Published at the fixed host _dmarc.yourdomain.com. Costs no SPF lookups.
Gmail and Yahoo require at least p=none for bulk senders. Enforcement earns more trust.
Without this, p=none does nothing at all. You get no reports and learn nothing.
Strict alignment breaks most sequencer and CRM sending. Use relaxed unless you know otherwise.
Your DNS records
Add these as TXT records at your DNS host. Publishing takes effect within minutes to a few hours depending on TTL. Then confirm what is actually live with the deliverability checker, which performs the real lookups and counts them against the limit.
Questions people actually ask
Why does SPF break at 10 lookups?
RFC 7208 caps an SPF evaluation at 10 DNS-querying mechanisms. Every include, a, mx, ptr, exists and redirect costs one, and an include costs everything it includes in turn. Cross the limit and the record returns permerror, at which point receivers treat your mail as unauthenticated. Nothing warns you: the record still looks fine in your DNS panel.
How do I get back under the limit?
Three moves, in order of value. Remove providers that no longer send for you, which is the most common win. Replace an include with the specific ip4 and ip6 ranges it publishes, because IP mechanisms cost zero lookups. Drop any ptr mechanism entirely, since it is deprecated and receivers may ignore the record because of it.
Can I publish two SPF records?
No. A domain must have exactly one TXT record starting v=spf1. Two records is a permanent error and authentication fails for everything. If you need another provider, add its include to the single existing record.
Should a cold email domain use p=reject?
Eventually, yes, but not on day one. Start at p=none with a rua address, confirm from the reports that your legitimate mail passes alignment, then move to quarantine and finally reject. Jumping straight to reject on a domain you have not observed will silently kill mail you wanted delivered.
Does this tool query DNS or store what I type?
Neither. This page is pure text building and runs entirely in your browser. It makes no DNS queries at all, which is deliberate: it means the tool cannot generate lookup traffic against your domain. Nothing you enter is sent to ReplyLead.
Why is DKIM not generated here?
DKIM cannot be generated by a third party. The key pair is created by your email provider, which holds the private half and publishes the public half at a selector it chooses. Generate it in Google Workspace, Microsoft 365 or your sequencer, then verify it resolves with the deliverability checker.
Records right, still landing in spam?
Authentication is necessary, not sufficient. Placement also turns on domain age, volume ramp, list quality and who is filtering on the receiving side. We run this for clients on a revenue-share model.
Apply to work with usAll free tools // Deliverability checker // Spam checker // Deliverability guide