How to use this tool
- Enter your sending domain and approved SPF mechanisms.
- Start DMARC with p=none and review a reporting destination.
- Review existing DNS, sender alignment and nested lookup counts before publishing.
Prepare demonstration DNS TXT records
Stage monitoring for example.com after inventorying the domain’s real mail senders. The documentation-only IP is deliberately not a real provider.
Input
Domain: example.com SPF mechanism: ip4:192.0.2.1 Final qualifier: ~all DMARC: none; relaxed alignment Reports: [email protected]
Expected output
{
"spf": {
"host": "example.com",
"value": "v=spf1 ip4:192.0.2.1 ~all"
},
"dmarc": {
"host": "_dmarc.example.com",
"value": "v=DMARC1; p=none; adkim=r; aspf=r; rua=mailto:[email protected]"
},
"lookupEstimate": 0,
"warnings": [
"Publish only one SPF record at this host. Merge existing senders before changing it.",
"Offline estimate only: nested includes, MX/A expansion, void lookups and existing DNS are not resolved.",
"External report destinations may require DNS authorization. Forensic reports may contain personal data."
]
}Publish the suggested name/value pairs through your DNS provider after merging any existing SPF senders. The current DMARC format omits historic pct. These offline strings do not resolve DNS, expand recursive SPF lookups, prove ownership, or establish that messages will authenticate.
More examples
- v=spf1 ip4:192.0.2.1 -all authorizes one documentation-only IP in a sample.
- DMARC for example.com belongs at _dmarc.example.com.
- include:example.com contributes a lookup mechanism but may expand into more nested lookups.
Know the limits
This is an offline syntax builder, not a DNS checker or email authenticator. Existing records, nested lookups, DKIM alignment and report-destination authorization need separate review.
Common questions
Can I add a second SPF record?
Do not publish multiple SPF records at the same host. Merge authorized senders into one record.
Does p=none enforce rejection?
No. It requests monitoring. Move toward enforcement only after checking legitimate mail alignment.