External Network Penetration Testing
Testing of everything you expose to the internet, from forgotten admin panels to VPN gateways, with every finding manually validated.
Free tool
SPF & DMARC Record Builder
Fill in who sends email for your domain and how strict you want to be. You'll get SPF and DMARC records to paste into your DNS, with every tag explained.
Runs entirely in your browser. Nothing you enter is sent to us.
SPF record
- Type
- TXT
- Host / name
- @
DMARC record
- Type
- TXT
- Host / name
- _dmarc
Get your email security reviewed
We check SPF, DKIM and DMARC as part of external network testing, alongside the rest of your internet-facing setup.
What each tag means
- v=spf1
- Identifies the record as SPF. Must come first.
- a
- Allows the IP addresses in your domain's A/AAAA records to send.
- mx
- Allows your domain's MX (mail server) hosts to send.
- ip4
- Allows a specific IPv4 address or range.
- ip6
- Allows a specific IPv6 address or range.
- include
- Allows everything another domain's SPF record allows. Each include costs at least one DNS lookup.
- -all
- Fail: mail from anywhere else should be rejected.
- ~all
- Soft fail: mail from anywhere else is suspicious but may be accepted.
- ?all
- Neutral: no statement about other senders.
SPF
- v=
- Identifies the record as DMARC. Must be DMARC1 and come first.
- p=
- What receivers should do with mail that fails DMARC: none (monitor), quarantine (spam folder) or reject.
- sp=
- The policy for subdomains. If left out, subdomains use p.
- rua=
- Where receivers send daily aggregate reports.
- ruf=
- Where receivers send per-message failure reports (rarely sent).
- adkim=
- DKIM alignment: r (relaxed) allows subdomains, s (strict) needs an exact domain match.
- aspf=
- SPF alignment: r (relaxed) allows subdomains, s (strict) needs an exact domain match.
- fo=
- When to send failure reports: 0 (all checks fail), 1 (any check fails), d (DKIM fails), s (SPF fails).
DMARC
How to use the result
Rolling out SPF and DMARC safely
- List every service that sends as your domain before publishing SPF: your mail provider, newsletters, CRM, billing, support desk. Missing one can send real email to spam.
- Publish SPF with ~all and set up DKIM signing with each provider.
- Start DMARC at p=none with rua= reports and review them for a few weeks to find senders you missed.
- Tighten gradually: p=quarantine, then p=reject, and move SPF to -all once you're confident.
Each DNS provider's interface is a little different. Add each record as a TXT record using the host shown. Some providers want the full name (for example _dmarc.yourdomain.com).
This tool doesn't look anything up in DNS. It can't see what your current records contain or how many lookups your includes use.
Background
How SPF, DKIM and DMARC fit together
- SPF lists the servers allowed to send email for your domain. Receivers check the sending server against the list.
- DKIM adds a cryptographic signature to each message, so receivers can confirm it wasn't changed in transit. Each email provider gives you its own DKIM record to publish.
- DMARC ties both to the address people see in the From line. A message passes when SPF or DKIM passes for a domain that matches the From domain. DMARC also tells receivers what to do with failures and where to send reports.
The SPF ten-lookup limit
The include, a, mx, ptr and exists mechanisms, and the redirect modifier, each make the receiver look up DNS. RFC 7208 caps these at ten per check, counting lookups inside included records. Go over the limit and receivers return a permanent error, which can make SPF fail for all your mail. If you're close to it, remove services you no longer use before adding new ones.
Reading DMARC reports
The address in rua= receives aggregate reports, usually daily, from large mailbox providers. They show which servers sent mail as your domain and whether it passed. Use them to find senders you missed before moving to p=quarantine or p=reject. The reports are XML, so a DMARC report viewer makes them much easier to read.
FAQ
SPF & DMARC Builder questions
Can a domain have two SPF records?
No. More than one SPF record is a permanent error, and SPF fails. Merge all your senders into a single record.
What's the difference between ~all and -all?
~all (soft fail) marks unlisted senders as suspicious, and -all (fail) says they're not allowed. With DMARC in place, receivers mostly act on your DMARC policy, so ~all is a safe default while you set things up.
Do domains that never send email need records?
Yes. Publish v=spf1 -all and a DMARC record with p=reject, so nobody can send convincing mail that appears to come from them.
Will p=reject stop all phishing that uses our name?
It stops exact spoofing of your domain at receivers that check DMARC. It doesn't stop lookalike domains, display-name tricks or mail sent from compromised accounts, which is why people still need to recognise phishing.