Vanorika Technologies

Free tool

SPF & DMARC Generator

Generate the exact DNS records that stop attackers spoofing email from your domain.
TXTName: @ (root)
v=spf1 include:_spf.google.com ~all

Tells the world which servers may send email for your domain.

TXTName: _dmarc
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.co.zw; fo=1; adkim=s; aspf=s

Tells receivers what to do with email that fails SPF/DKIM.

How to use these

Add both as TXT records in your domain's DNS panel (e.g. name.co.zw → DNS → TXT). Start DMARC on p=none to monitor for a week or two, then move to quarantine. If you also use a separate provider (newsletters, CRM), add their include: to the SPF record before ~all.

Not sure these are right for your setup? We'll configure email security for you as part of a free assessment.

Get help setting this up

What this checks

  • Builds an SPF record for your chosen mail provider: Google Workspace, Microsoft 365, Zoho Mail, or a bare record if you are not sure.
  • Builds a DMARC record with your chosen policy (none, quarantine or reject) and a reporting address of dmarc@ your domain.
  • Sets strict alignment for both SPF and DKIM (aspf=s and adkim=s) and asks for failure reports with fo=1.
  • Shows the record type and host name for each, ready to copy into your DNS panel. Everything is generated in your browser.

Why it matters

Writing SPF and DMARC by hand is where small typos break email delivery or leave a domain wide open. A generator gives you a correct starting point in the right syntax, so you can publish protection today instead of waiting for a technician. For a small organisation using Google Workspace, Microsoft 365 or Zoho, these two records are often all that is missing.

How to read the result

  • The SPF record goes on the root of the domain, shown as @ in most DNS panels. The DMARC record goes on the host name _dmarc.
  • The SPF record ends in ~all (soft fail). It flags unlisted senders rather than hard failing them, which is the safer setting while you confirm every sender is included.
  • Strict alignment means the From domain must match the SPF and DKIM domains exactly, not just share a parent. If a service sends from a subdomain, relaxed alignment (aspf=r, adkim=r) may suit you better.
  • The reporting address dmarc@ your domain must be a real mailbox or alias, or the aggregate reports will bounce.

How to fix what it finds

  • Add any other service that sends as you, such as a newsletter, CRM or invoicing tool, by placing its include: mechanism before ~all.
  • Keep SPF within 10 DNS lookups, the limit set by RFC 7208; each include counts, so remove services you no longer use.
  • Create the dmarc@ mailbox or alias before publishing, or change rua to an address you already monitor.
  • Start on p=none, read the reports for a week or two, then move to quarantine and eventually reject.

Want it fixed for you, or tested properly? See what a test would cost or book a free 30 minute call.

Questions people ask

Where do I add SPF and DMARC records?

In the DNS management panel wherever your domain's name servers point, which may be your registrar, your hosting cPanel or a service like Cloudflare. Add both as TXT records using the host names shown. The DNS Records Lookup tool shows your name servers if you are not sure.

What does ~all mean compared with -all?

Both describe what to do with mail from servers not listed. ~all is a soft fail that marks it as suspicious, while -all is a hard fail. With DMARC enforcing, ~all is widely used because DMARC makes the final decision.

How long do new DNS records take to work?

Usually minutes to a few hours, depending on the TTL of the records and any cached answers. Run the Email Security Checker afterwards to confirm both records are visible.

Related free tools