Skip to content
MtrXTools

SPF & DMARC record builder

Build an SPF record from the services that send your mail, see its DNS lookup count against the limit of 10 as you go, and create a DMARC record with reporting and a safe rollout. Import your current records to edit them. Runs in your browser.

What SPF and DMARC records do

SPF is a TXT record at your domain listing the servers allowed to send its mail, such as v=spf1 include:_spf.google.com -all. DMARC is a TXT record at _dmarc.<domain> that tells receivers what to do with mail that fails SPF and DKIM alignment, and where to send reports.

Build both here, or import the records you already publish to edit them. The builder runs in your browser; imports and lookup counts read your public DNS.

The SPF limit of 10 DNS lookups

RFC 7208 lets receivers make at most 10 DNS lookups while checking SPF. Past that the result is permerror and SPF fails for all your mail. Includes count with everything inside them, so one provider can cost four or more.

  • include, a, mx, ptr, exists and redirect cost one lookup each, plus the lookups inside an included record.
  • ip4, ip6 and all cost nothing, so list your own servers by address.
  • At most 2 lookups may find nothing (void lookups) before receivers return permerror.
  • A domain must publish exactly one SPF record. Two records is a permanent error, so edit the existing one.

A safe DMARC rollout

  • Publish p=none with a rua address and read the daily aggregate reports for two to four weeks.
  • Fix SPF or DKIM for every legitimate service that sends as you.
  • Move to p=quarantine, optionally with a lower pct at first.
  • Finish at p=reject, which stops spoofing of your domain.

Reports sent to a mailbox on another domain need that domain to publish <yourdomain>._report._dmarc.<theirdomain> with v=DMARC1. The builder can check it for you.

Questions

Should I use -all or ~all?
Use -all once every service that sends for you is listed; unlisted servers then fail SPF. ~all (soft fail) is fine while you are still finding senders, and with DMARC at quarantine or reject the DMARC policy decides either way. Never use +all.
How do I fix too many DNS lookups?
Remove services you no longer use, list your own servers with ip4 and ip6 instead of a and mx, and check whether a provider offers a smaller include. Flattening includes into IP ranges works, but breaks when the provider changes its addresses.
My SPF record is longer than 255 characters. Is that a problem?
No, but a single TXT string holds at most 255 characters, so the record is published as several strings that receivers join back together. Most DNS providers split it for you; otherwise enter it as quoted strings, as in the zone-file line.
Do I still need pct in DMARC?
Receivers still honour pct, which applies the policy to only part of your failing mail. DMARCbis, the revision of the standard, replaces it with a t=y testing flag, so treat pct as a short rollout step and finish at 100.

Related tools