DNS Record Builder

SPF record

Lists which servers may send mail for your domain. Publish it as a TXT record on your root domain. Keep total DNS lookups (include, a, mx) at 10 or under.

Authorise your own servers The domain's MX hosts may send mail The domain's A/AAAA host may send mail

Provider includes

One include per line (or comma-separated).

IPv4 addresses

IPv6 addresses

How to treat everything else (all)

DMARC record

Tells receivers what to do with mail that fails SPF/DKIM, and where to send reports. Publish as a TXT record at _dmarc.<domain>. Start at p=none to monitor, then tighten.

Policy (p)

Subdomain policy (sp)

Aggregate report address (rua)

Daily XML summaries. Comma-separate multiple addresses. Strongly recommended.

Forensic report address (ruf, optional)

Failure reporting options (fo) 1 — if SPF or DKIM isn't aligned d — on any DKIM signature failure s — on any SPF failure

Only takes effect when a ruf address is set.

DKIM alignment (adkim)

SPF alignment (aspf)

Apply to % (pct)

Report interval seconds (ri, optional)

BIMI record

Publishes your brand logo for supporting inboxes. Publish as a TXT record at default._bimi.<domain>. Requires an enforced DMARC policy (quarantine or reject) and an SVG Tiny PS logo over HTTPS.

Logo URL (l=)

HTTPS link to an SVG Tiny PS logo.

Verified Mark Certificate URL (a=, optional)

Required by Gmail and some others to actually display the logo.

MTA-STS

Requires inbound mail to use TLS. Needs a DNS record and a policy file hosted at https://mta-sts.<domain>/.well-known/mta-sts.txt.

Mode

Max age (seconds)

Allowed MX host patterns

One per line. Must match the hosts in your MX records (wildcards allowed).

TLS report address (TLS-RPT, optional)

Adds a companion _smtp._tls record for TLS failure reports.

SPF record

DMARC record

BIMI record

MTA-STS

Generated record