# SPF and DMARC generators

> Build an SPF or DMARC TXT record in your browser, publish it in DNS and check it with the matching checker.

Source: https://docs.vigilbase.com/tools/record-generators

The SPF and DMARC generators build DNS records in your browser. Nothing is sent to Vigilbase. When you have published a record, check it with the matching [email record checker](https://docs.vigilbase.com/tools/email-checkers).

## SPF Generator

Use the [SPF Generator](https://vigilbase.com/tools/spf-generator) to build a TXT record that follows RFC 7208, with its DNS lookup count.

:::steps
1. **List your senders.** Add the `include` for each mail service, plus any IPv4 and IPv6 addresses or ranges, and `a` or `mx` if those hosts send mail.
2. **Choose the all qualifier.** Pick `~all` while you confirm every sender, or `-all` once the list is complete.
3. **Publish and check.** Copy the record into one TXT record at your domain, replacing any existing SPF record, then run the [SPF Checker](https://vigilbase.com/tools/spf-checker).
:::

The generator warns when the record goes over 10 DNS lookups, and when it gets close. Its count covers only this record's own terms: each include adds the lookups inside the included record, so the real total is higher.

One DNS character-string holds 255 characters. For a longer record, the generator shows it split into several quoted strings in one TXT record; receivers join them without spaces.

## DMARC Generator

Use the [DMARC Generator](https://vigilbase.com/tools/dmarc-generator) to build a TXT record for `_dmarc` that follows RFC 7489 and the changes in RFC 9989.

:::steps
1. **Choose a policy.** Start with `p=none` to collect reports without affecting delivery.
2. **Add report addresses.** Enter at least one `rua` address for aggregate reports. Set `sp`, `adkim`, `aspf`, `fo` or `ruf` only if you need them.
3. **Publish and check.** Copy the record into a TXT record at `_dmarc` for your domain, then run the [DMARC Checker](https://vigilbase.com/tools/dmarc-checker).
:::

Move to `p=quarantine` once reports show every legitimate sender passing SPF or DKIM with alignment, then to `p=reject`. You do not need a `ruf` address: failure reports can contain personal data and many large mailbox providers do not send them.

## Reports

The generators have no stored run, so they cannot email a report. Their checkers can.