← All Tools

Email Auth Record Builder

Build valid SPF, DKIM, and DMARC TXT records with guided choices, common-mistake warnings, and an SPF DNS-lookup estimate — or paste an existing record to lint it. 100% client-side.

🔒 100% client-side. Keys and addresses you paste stay in your browser — nothing is sent to a server.

Your domain Optional, but it makes the host names concrete and lets us check external DMARC reporting.

SPF — published as a TXT record at the domain apex (`@`)

Sending IPs / CIDRs (one per line) Include domains (one per line) include a (the domain's own A/AAAA) include mx (the domain's mail servers) All-mechanism qualifier

DKIM — published as a TXT record at `selector._domainkey`

Selector Key type Public key (Base64 body only, no PEM headers) testing flag t=y

DMARC — published as a TXT record at `_dmarc`

Policy p Subdomain policy sp Percentage pct Aggregate reports rua Failure reports ruf DKIM alignment adkim SPF alignment aspf Failure options fo (needs ruf)

Lint an existing record

Paste a published TXT record (one per line) starting with v=spf1, v=DKIM1 or v=DMARC1. The type is detected automatically.

Record(s) to check

All records (zone-file snippet)

Where to publish: add each line as a TXT record in your DNS zone at the host shown (SPF at @, DKIM at selector._domainkey, DMARC at _dmarc). Allow for DNS propagation, then verify with the Email Security Checker.

📧 Email Auth Record Builder

SPF — published as a TXT record at the domain apex (@)

DKIM — published as a TXT record at selector._domainkey

DMARC — published as a TXT record at _dmarc