SPF, DKIM & DMARC Generator

SPF

Define which mail servers and services are allowed to send email for your domain.

Not sure what to enter? That's OK. Select your email provider above and leave the other options at their defaults.

Domain

Enter the domain that will use this SPF record.

Who sends email for this domain?

Select the services that send email for your domain.

Google Workspace Microsoft 365 Amazon SES Mailgun SendGrid Custom

Generated SPF record

v=spf1 ~all

Advanced SPF options Optional

These options are optional and are intended for advanced SPF configurations.

IPv4 addresses

Optional Use this only if your own server sends email directly.

IPv6 addresses

Optional Use this only if your own server sends email directly.

Additional SPF includes

Optional Use this only for additional mail services not listed above.

A mechanism

Allow servers matching the domain A record to send email.

MX mechanism

Allow servers listed in the domain MX records to send email.

EXISTS mechanism

Use a DNS lookup to determine whether a sender is authorized.

Redirect

Use another domain as the final SPF policy. This replaces the ~all / -all / ?all setting.

SPF policy

Use ~all while testing. A stricter -all policy should only be used when you are confident that all legitimate senders are included.

~all -all ?all

DKIM

Authenticate outgoing email with a cryptographic signature tied to your domain.

Domain

Enter the domain that will use this DKIM record.

Selector

Enter the selector provided by your email provider, for example selector1 or mail.

Key type

Viglar currently supports RSA DKIM keys.

RSA

Public key

Paste the DKIM public key provided by your email provider. You do not need to paste the private key.

Viglar does not generate or store private DKIM keys. Only the public key is needed here.

Generated DKIM record

DNS hostname

TXT record

DMARC

Tell receiving mail servers how to handle messages that fail SPF or DKIM authentication.

Domain

Enter the domain that will use this DMARC record.

Policy

Choose what receiving mail servers should do when a message fails DMARC.

none quarantine reject

Aggregate reports

Optional. Email addresses that should receive aggregate DMARC reports.

Let Viglar handle my DMARC reports

Viglar can collect and analyse aggregate reports to help you identify email-sending sources and authentication failures. Viglar will start receiving reports after the DNS record is published and mail providers begin sending them.

Percentage

Percentage of messages to which the DMARC policy should be applied.

Advanced options

Optional DMARC settings for more specific reporting and alignment behavior.

Subdomain policy

Optional. Policy applied to subdomains. Leave empty to inherit the main policy.

Forensic reports

Optional. Email addresses that should receive DMARC failure reports.

DKIM alignment

Relaxed alignment allows the authenticated DKIM domain to be a subdomain. Strict alignment requires an exact domain match.

SPF alignment

Relaxed alignment allows the authenticated SPF domain to be a subdomain. Strict alignment requires an exact domain match.

Failure reporting

Optional. Controls when forensic failure reports may be generated.

Report interval

Optional. Requested interval for aggregate reports, in seconds.

Generated DMARC record

DNS hostname

TXT record

Want to understand SPF, DKIM and DMARC?

Read the Viglar guide to email authentication and learn what these records do and what to watch for.

Read the Email Authentication guide →

Keep your email authentication under control

Viglar can monitor your SPF, DKIM and DMARC records and alert you when your email authentication configuration changes.

Create a free account

Email Authentication Generator

SPF

DKIM

DMARC

Want to understand SPF, DKIM and DMARC?

Keep your email authentication under control