// TOOLS

Security Tools

🔏 SPF / DMARC / DKIM Generator

The three DNS records that stop your domain from being spoofed in email. Fill in the fields and copy the ready-to-use TXT for your provider. DKIM generates an RSA key pair in your own browser: the private key never leaves this page.

Your domain Record

SPF — Who may send as you

Tick the services you send mail from. SPF allows a maximum of 10 DNS lookups: we warn you if you exceed it.

Sending services

Frequently asked questions

What are SPF, DKIM and DMARC for, together?
They are the three layers that stop someone from sending mail pretending to be your domain. SPF says which servers may send, DKIM signs the message cryptographically and DMARC decides what to do with anything that does not add up and sends you reports.
Does the DKIM private key leave my browser?
No. The key pair is generated with WebCrypto in your own browser; the private key is sent to no server. Publish the public one in DNS and keep the private one to install on your mail server. If you reload the page, the private key is lost.
Why does it warn about the 10-lookup SPF limit?
Because the SPF standard allows at most 10 DNS lookups when evaluating the record (each include, a, mx… counts). If you exceed it, many receivers return permerror and your SPF stops protecting you. Reduce or consolidate the includes.
Can I start DMARC straight at reject?
Better not to. Start at p=none with an rua address, review the reports for a few weeks to confirm SPF and DKIM align for all your legitimate mail, then move to quarantine and finally reject. That way you do not drop good mail.