Skip to content
CCM Tools

Email DNS Generator

Generate the full set of email authentication records — SPF, DKIM and DMARC.

SPF record

Authorises the servers allowed to send mail as this domain.

Quick presets
Both presets use ~all — softfail while the domain is still being cut over.
One domain per line. Each becomes an include: mechanism and costs one DNS lookup.
Add another sender
Appends the sender's include: value to the list above.
Mechanisms
One IP or CIDR range per line. Mail server IPs only — never a resolver.
One IP or CIDR range per line.
Roll out on ~all, then tighten to -all once the reports are clean.
Your SPF record will appear here…

DMARC record

Tells receivers what to do with mail that fails SPF and DKIM, and where to send the reports.

Quick start Resets every field below and emits a p=none record — the right starting point for a domain with no DMARC at all.
Start on none and read the reports before enforcing anything.
Share of mail the policy applies to (0–100). Only emitted when it is not 100.
Daily XML summaries. Comma-separate for more than one address.
Per-failure copies. Optional, and most receivers ignore it.
Seconds between aggregate reports. Only emitted when it is not 86400.
Your DMARC record will appear here…

Records to add

Everything generated above, in the shape a DNS panel asks for it.

No records yet

Generate an SPF or DMARC record and it will be listed here, ready to paste.

About SPF and DMARC

SPF (Sender Policy Framework)

SPF helps prevent email spoofing by specifying which mail servers are authorised to send email on behalf of your domain.

  • include: Include another domain's SPF record
  • a: Authorise the domain's A record
  • mx: Authorise the domain's MX records
  • ip4: Authorise a specific IPv4 address or range
  • ip6: Authorise a specific IPv6 address or range
  • all: Default action for non-matching senders

Best practices

  • Use -all (fail) for a strict policy, ~all (softfail) for a gradual rollout
  • Keep DNS lookups under 10 — include, a, mx, ptr and exists each count as one
  • Only list IP addresses of actual mail servers, never DNS resolvers
  • Test with ~all before switching to -all
  • One SPF record per domain — never two TXT records starting with v=spf1

DMARC (Domain-based Message Authentication)

DMARC builds on SPF and DKIM to give domain owners control over what happens to email that fails authentication.

  • none: Monitor mode — no action taken, reports only
  • quarantine: Treat suspicious email as spam
  • reject: Reject unauthenticated email entirely
  • rua: Aggregate reports (daily summaries)
  • ruf: Forensic reports (individual failures)
Always start with p=none and read a fortnight of aggregate reports before enforcing anything. Going straight to p=reject on a domain you have not measured is how a client stops receiving their own invoices.