Free tool · 100% in-browser

SPF, DKIM & DMARC record generator

Build correct SPF, DKIM and DMARC records for PowerMTA in seconds. The DKIM key pair is generated locally with the Web Crypto API — your private key never leaves your browser. Copy or download the results and the matching PowerMTA domain-key line, then publish in your DNS.

↓ SPF ↓ DKIM ↓ DMARC

SPF record

TXT @ your domain

Authorize the IPs and services allowed to send for your domain.

Sending domain Enforcement IPv4 addresses / ranges (one per line or comma-separated) IPv6 addresses / ranges (optional) include: domains (optional — e.g. third-party senders)

include a include mx

Generated SPF record

v=spf1 -all

Publish as a TXT record on example.com. Keep one SPF record per domain.

DKIM key & record

generated locally

A real RSA key pair, created in your browser. The private key never leaves this page.

Domain Selector Key size

DNS host

DNS TXT value

Split version (for DNS providers with a 255-char limit)

PowerMTA domain-key directive

Private key (keep secret)

Keep the private key safe on your PowerMTA server (e.g. /etc/pmta/dkim/) and never publish it. Only the DNS TXT value above goes public.

DMARC record

TXT @ _dmarc.domain

Tell receivers what to do when SPF/DKIM don't align — and where to send reports.

Domain Policy (p) Aggregate reports (rua) Forensic reports (ruf, optional) Percentage (pct) Subdomain policy (sp, optional) DKIM alignment (adkim) SPF alignment (aspf)

DNS host

_dmarc.example.com

Generated DMARC record

v=DMARC1; p=none; rua=mailto:[email protected]; pct=100; adkim=r; aspf=r

Generator FAQ

Is this SPF/DKIM/DMARC generator free and private?+

Yes. Everything runs entirely in your browser — no data is sent to a server. DKIM key pairs are generated locally with the Web Crypto API, so your private key never leaves your machine. Copy or download the results and publish them in your own DNS.

How is the DKIM key generated?+

Your browser generates a real RSA key pair using the built-in Web Crypto API. You get the private key as a PEM file to keep on your PowerMTA server, the DNS TXT record (v=DKIM1; k=rsa; p=…) to publish, and the matching PowerMTA domain-key directive line.

My DKIM record is too long for DNS — what do I do?+

A 2048-bit DKIM public key exceeds the 255-character limit for a single DNS string. Most providers accept a TXT value split into multiple quoted strings — this tool shows the split version. If your provider has a single-field UI that rejects it, paste the whole value; many panels split it automatically.

Which DMARC policy should I publish first?+

Start with p=none and an rua reporting address you actually monitor. Watch the aggregate reports until SPF and DKIM align for all your legitimate mail, then tighten to p=quarantine and finally p=reject. Publishing reject before you've verified alignment can silently block your own mail.