SPF and DMARC generators

The SPF and DMARC generators build DNS records in your browser. Nothing is sent to Vigilbase. When you have published a record, check it with the matching email record checker.

SPF Generator

Use the SPF Generator to build a TXT record that follows RFC 7208, with its DNS lookup count.

1. 1

   List your senders. Add the include for each mail service, plus any IPv4 and IPv6 addresses or ranges, and a or mx if those hosts send mail.

2. 2

   Choose the all qualifier. Pick ~all while you confirm every sender, or -all once the list is complete.

3. 3

   Publish and check. Copy the record into one TXT record at your domain, replacing any existing SPF record, then run the SPF Checker.

The generator warns when the record goes over 10 DNS lookups, and when it gets close. Its count covers only this record's own terms: each include adds the lookups inside the included record, so the real total is higher.

One DNS character-string holds 255 characters. For a longer record, the generator shows it split into several quoted strings in one TXT record; receivers join them without spaces.

DMARC Generator

Use the DMARC Generator to build a TXT record for _dmarc that follows RFC 7489 and the changes in RFC 9989.

1. 1

   Choose a policy. Start with p=none to collect reports without affecting delivery.

2. 2

   Add report addresses. Enter at least one rua address for aggregate reports. Set sp, adkim, aspf, fo or ruf only if you need them.

3. 3

   Publish and check. Copy the record into a TXT record at _dmarc for your domain, then run the DMARC Checker.

Move to p=quarantine once reports show every legitimate sender passing SPF or DKIM with alignment, then to p=reject. You do not need a ruf address: failure reports can contain personal data and many large mailbox providers do not send them.

Reports

The generators have no stored run, so they cannot email a report. Their checkers can.