IGSendMail

SPF, DKIM & DMARC Record Generator

Build copy-paste DNS TXT records for any domain in seconds. This free SPF DKIM DMARC generator assembles a valid SPF record, a DMARC record generator with the right alignment and reporting tags, and a DKIM record from your provider's public key — no signup, all client-side.

Which services send email for you?

A domain may only have one SPF (v=spf1) record. If one already exists, merge these mechanisms into it instead of publishing a second record — two SPF records is itself a failure.
Type: TXTHost / Name: @
v=spf1 ~all

Publish this TXT record on yourdomain.com (host "@" or the root domain). It tells receiving servers exactly which services are allowed to send mail as your domain.

Everything runs in your browser. Nothing is uploaded or stored. After publishing, allow up to 24–48 hours for DNS changes to propagate before testing.

Why SPF, DKIM, and DMARC all matter

Mailbox providers like Gmail, Outlook, and Yahoo use email authentication as one of the strongest signals for inbox placement. Each record proves a different thing — and you need all three working together to reliably land in the inbox.

SPF — who can send

SPF (Sender Policy Framework) is a TXT record listing the servers and services authorized to send mail for your domain. When a receiver gets mail claiming to be from you, it checks the envelope sender against your SPF record. Missing or broken SPF is the most common reason legitimate mail gets flagged as spoofing.

DKIM — proof it wasn't altered

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message. Receivers verify it against the public key you publish at selector._domainkey.yourdomain.com, proving the mail genuinely came from you and wasn't tampered with in transit. Gmail and Yahoo bulk-sender rules require it.

DMARC — the policy and reports

DMARC (Domain-based Message Authentication, Reporting & Conformance) ties SPF and DKIM together. It tells receivers what to do when authentication fails — monitor, quarantine, or reject — and sends you aggregate reports on who is sending mail as your domain. Since February 2024, Gmail and Yahoo require DMARC for bulk senders.

IGSendMail configures SPF, DKIM, and DMARC automatically when you verify your sending domain — most users are fully authenticated in under 10 minutes. This free generator is for when you want to publish the records by hand.

Frequently asked questions

SPF, DKIM, and DMARC are three DNS-based email authentication standards. SPF lists which servers may send mail for your domain, DKIM cryptographically signs each message so receivers can verify it wasn't altered, and DMARC tells receivers what to do when SPF or DKIM fail and sends you reports. Together they prove your mail is genuine and keep it out of spam.

Yes. Since February 2024 Gmail and Yahoo require SPF, DKIM, and DMARC for bulk senders, and all three improve inbox placement for everyone. SPF and DKIM authenticate your mail, and DMARC ties them together with an enforcement policy and reporting. Skipping any one leaves a gap that spoofers and spam filters can exploit.

Start at p=none with a rua reporting address. This monitors who is sending mail as your domain without affecting delivery. After two to four weeks of clean reports, move to p=quarantine, then finally p=reject for full protection. Ramping gradually prevents accidentally blocking legitimate mail you forgot to authenticate.

Without these records, mailbox providers can't verify your mail is genuinely from you, so they treat it as potential spoofing or phishing and route it to spam — or reject it outright. Authentication is one of the strongest signals Gmail, Outlook, and Yahoo use to decide inbox placement, so missing records almost always hurt deliverability.

An SPF record is a TXT record on your root domain listing the servers and includes authorized to send your mail. A DKIM record is a TXT record at selector._domainkey.yourdomain.com containing a public key your sending provider uses to verify message signatures. SPF authorizes senders; DKIM proves message integrity.

Your DKIM public key is issued by your email sending provider — for example IGSendMail, Google Workspace, Microsoft 365, SendGrid, or Brevo. Find it in the provider's domain authentication or DNS settings dashboard, which also gives you the selector name. Paste the selector and key into the generator above to assemble the full TXT record.

Skip the DNS guesswork

IGSendMail sets up SPF, DKIM, and DMARC automatically and delivers 99% inbox placement with dedicated IPs and real-time reputation monitoring.

Want to test what you just published? Run the free Deliverability Audit.