DNS Record Generator (SPF, DKIM, DMARC, MX & BIND Zone)

Record Type:
Time To Live (TTL):

Configure SPF Parameters

Sender Policy Framework specifies which IP addresses are authorized to send email on behalf of your domain.
Generated DNS Zone Record (BIND Format)
example.com.	3600	IN	TXT	"v=spf1 a mx ip4:192.0.2.1 include:_spf.google.com ~all"
Raw Value (For Cloudflare / GoDaddy / Route 53 fields):v=spf1 a mx ip4:192.0.2.1 include:_spf.google.com ~all
TypeSPF
Target Hostexample.com
TTL Value3600s
Syntax ValidRFC Compliant

100% Client-Side Generation

Domain names, mail servers, and internal authentication selectors are assembled strictly inside browser memory. Zero DNS reconnaissance telemetry.

BIND & Cloud Provider Standard

Produces universal BIND syntax compatible with Cloudflare, AWS Route 53, Google Cloud DNS, BIND9, PowerDNS, and NSD zone files.

Full Email Security Trio

Generates harmonized SPF IP authorization, DKIM public key tags, and DMARC enforcement policies to eliminate email spoofing.

Technical Reference & Architecture Guide

DNS Record Generation & Zone Management Guide — Reference Guide

Standards and syntax rules for constructing RFC-compliant SPF email policies, DMARC enforcement records, DKIM public keys, MX priority lists, CAA, and BIND zone files.

Key Parameters & Controls

recordTypeenum ('SPF' | 'DMARC' | 'DKIM' | 'MX' | 'CAA' | 'TXT')

DNS record specification standard to generate.

domainstring (FQDN)

Fully Qualified Domain Name receiving the DNS policy.

ttlnumber (default: 3600)

Time-To-Live caching duration in seconds for resolver caches.

Pro Tips & Best Practices

Never configure more than one SPF TXT record on a domain root; multiple SPF records invalidate SPF evaluation across major mail providers.

Keep SPF DNS lookups under the hard RFC 7208 limit of 10 mechanisms (e.g. include, a, mx) to prevent ~all permanent errors.

Start DMARC implementation with 'p=none' for passive telemetry monitoring before escalating to 'p=quarantine' or 'p=reject'.

Common Gotchas & Troubleshooting

Audit your SPF string and remove obsolete 'include:' vendors or flatten IP ranges into 'ip4:' blocks.

Ensure your rua mailto: address has valid MX records and accepts external abuse reports.

Frequently Asked Questions

What is the difference between SPF, DKIM, and DMARC?▼

SPF validates sending server IPs, DKIM cryptographically signs message bodies, and DMARC dictates enforcement policy when SPF or DKIM fails.

Can I import the generated records into Cloudflare, Route 53, or GoDaddy?▼

Yes. The output matches standard BIND zone format and raw value strings accepted by all major DNS providers.

Does this tool make actual DNS queries to my domain?▼

No. The generator runs completely client-side in browser memory without contacting DNS servers.

What is the CAA record used for?▼

Certificate Authority Authorization (CAA) records specify which CAs (like Let's Encrypt or DigiCert) are permitted to issue SSL certificates for your domain.

Related Tools & Utilities

All Tools →