Free tool
SPF and DMARC record generator and 10-lookup checker
Generate copy-ready SPF (v=spf1) and DMARC (v=DMARC1) DNS TXT records in your browser, count DNS-querying mechanisms against RFC 7208 Section 4.6.4, and review the published bulk sender rules from Google, Yahoo, and Microsoft. Nothing you type leaves your browser.
Need hands-on repair for failing email authentication or spam placement? See our email deliverability fix service.
DNS TXT records
The records appear here as you type. This needs scripting on.
RFC 7208 and RFC 7489 checks
Published IETF RFC limits and mailbox provider thresholds
Every limit and threshold below is taken directly from published IETF specifications and official Google, Yahoo, and Microsoft sender documentation (all verified Nov 9, 2026).
| Standard or provider | Parameter / requirement | Published limit or threshold | Source and read date |
|---|---|---|---|
| SPF (IETF RFC 7208) | DNS-querying mechanisms and modifiers | Maximum 10 DNS lookups across include, a, mx, ptr, exists, and redirect. Exceeding 10 returns permerror. Maximum 2 void lookups (0-answer or NXDOMAIN). | RFC 7208 Section 4.6.4 (April 2014, read Nov 9, 2026) |
| SPF (IETF RFC 7208) | Single DNS TXT character-string length | Maximum 255 octets per single TXT string without splitting into multiple quoted strings; recommended to stay within a 512-octet DNS UDP packet to avoid truncation. | RFC 7208 Section 3.3 and 4.6.4 (read Nov 9, 2026) |
| DKIM (IETF RFC 6376) | RSA public key length in <selector>._domainkey | Signers must use at least 1024-bit RSA keys; 2048-bit RSA keys are recommended for long-term cryptographic resistance and supported by Google Workspace and Microsoft 365. | RFC 6376 Section 3.3 and Google Workspace Help 81126 (read Nov 9, 2026) |
| DMARC (IETF RFC 7489) | Identifier alignment (adkim / aspf) | At least one authenticated identifier (SPF RFC5321.MailFrom or DKIM d=) must match the visible RFC5322.From domain in relaxed (r, organizational domain) or strict (s, exact hostname) mode. | RFC 7489 Section 3.1 and 6.3 (March 2015, read Nov 9, 2026) |
| Google Gmail | Bulk sender volume and spam rate ceiling | 5,000+ messages in 24 hours to personal Gmail accounts triggers bulk requirements: SPF + DKIM + DMARC (p=none minimum) with alignment, RFC 8058 one-click unsubscribe for marketing mail, and Postmaster Tools spam rate below 0.10% (never reaching 0.30%). | Google Email Sender Guidelines (support.google.com/a/answer/81126, read Nov 9, 2026) |
| Yahoo Mail | Bulk sender authentication and complaint ceiling | Requires SPF and DKIM, published DMARC (p=none minimum) with alignment, valid forward and reverse DNS (PTR), one-click unsubscribe on promotional mail, and user complaint rate below 0.30%. | Yahoo Sender Best Practices (senders.yahooinc.com/best-practices/, read Nov 9, 2026) |
| Microsoft Outlook.com | High-volume consumer domain requirements | Domains sending over 5,000 emails per day to consumer @outlook.com, @hotmail.com, and @live.com addresses must pass SPF, DKIM, and DMARC with alignment; non-compliant messages are routed to Junk or rejected with 550 5.7.515. | Microsoft TechCommunity High-Volume Sender Requirements (effective May 5, 2025, read Nov 9, 2026) |
When a generator is not enough
Generating valid syntax is the first step. If your domain has multiple third-party senders pushing you past 10 DNS lookups, unaligned DKIM selectors on CRM or billing mail, or elevated spam complaint rates in Google Postmaster Tools, see our email deliverability fix service.
Read our supporting guides on SPF, DKIM, and DMARC explained, the Gmail, Yahoo, and Microsoft sender requirements, and the cold email infrastructure checklist, or return to all free SEO tools.
Questions about SPF and DMARC records
What counts toward the 10 DNS lookup limit in RFC 7208?
Under RFC 7208 Section 4.6.4 (Sender Policy Framework, April 2014, read Nov 9, 2026), an SPF check must not perform more than 10 DNS-querying mechanisms or modifiers in total. The mechanisms include, a, mx, ptr, and exists, plus the redirect modifier, each count toward that limit, along with any nested lookups inside included third-party SPF records. The ip4, ip6, and all mechanisms do not perform DNS queries and count as zero lookups.
What happens if an SPF record exceeds 10 DNS lookups?
RFC 7208 Section 4.6.4 specifies that when an SPF evaluation exceeds 10 DNS-querying mechanisms or modifiers, the receiving mail server returns permerror (permanent error). Under DMARC (RFC 7489), an SPF permerror is treated as an SPF authentication failure, which can cause mail to fail DMARC unless an aligned DKIM signature passes on the same message.
What is the difference between ~all (softfail) and -all (fail) in SPF?
In RFC 7208 Section 4.7 and Section 8.4, ~all returns a SoftFail result when a sending IP does not match any listed mechanism (meaning the host is not authorized, in transition), whereas -all returns a hard Fail result (explicitly unauthorized). Both evaluate after all prior mechanisms in the record have been checked.
Should I start DMARC at p=none, p=quarantine, or p=reject?
RFC 7489 Section 10.2 and Google Workspace Admin Help (Set up DMARC, support.google.com/a/answer/2466580, read Nov 9, 2026) recommend starting a new deployment at v=DMARC1; p=none; with an aggregate reporting address (rua=mailto:...) so you can verify that every legitimate sending service passes aligned SPF or DKIM before enforcing p=quarantine or p=reject.
Does this generator query external DNS or store my domain name?
No. Every calculation runs locally in your browser using JavaScript. No domain names, IP addresses, or reporting addresses leave your device. The lookup counter estimates top-level mechanisms directly from your selections plus typical published nested lookup counts for common providers.
Book a call with us
A 30-minute call in your working hours. Tell us what you sell and where, and we will tell you what we would do first and what it involves. Prefer email? Send your website through the form and the Passieon Team will reply by email.