Email Auth DNS Tools
Build and analyze SPF, DKIM, and DMARC DNS TXT records in the browser.
Building and analyzing SPF, DKIM, and DMARC TXT records
Email authentication relies on DNS TXT records: SPF lists authorized senders, DKIM publishes signing keys, and DMARC sets a domain policy for failed checks. Builders assemble records from simple fields; analyzers flag missing v= tags, weak all mechanisms, empty DKIM keys, and p=none monitor-only policies.
Search intent for SPF builder, DKIM inspector, and DMARC analyzer is day-two operations: fix deliverability after adding a ESP, rotate a selector, or move from p=none to quarantine. Stay under SPF's ten-DNS-lookup budget when chaining include: mechanisms.
Common pitfalls: publishing +all, forgetting _dmarc host names, revoking DKIM with an empty p= without updating selectors, and enabling reject before rua reports arrive. This toolkit does not query live DNS; paste records you already fetched.
Edit records locally when they include internal report addresses or staging selectors. Browser-side parsing keeps mailbox URIs off third-party DNS paste tools.
Reference Guide
DevOps tool - all processing runs locally in your browser. No data is sent to a server.
Operation: spf-build
Paste input, click Run, and copy the result. For two-input tools, fill both fields before running.
Example Input
include:_spf.google.com include:spf.protection.outlook.com -all
A sample loads automatically when you open this tool. Use Load Sample to reset it.