Email Authentication Builder

Build and cross-check SPF, DKIM, and DMARC DNS TXT records without sending keys or domains anywhere.

Domain

Mail domain

SPF

Mechanisms and modifiers after v=spf1Supported: all, include, a, mx, ip4, ip6, exists, ptr, redirect, and exp, with standard qualifiers.

DKIM

Selector

Key type

Optional flags

Public key (Base64 only, no PEM headers)

DMARC

Policy

Subdomain policy

Percentage

SPF alignment

DKIM alignment

Failure options

Aggregate report URIs (comma-separated mailto)

Failure report URIs (comma-separated mailto)

Alignment scenario

RFC5322.From domain

SPF-authenticated domain

DKIM signing d= domain

SPF authentication passes DKIM authentication passes

Import supported record values

One SPF, DKIM, or DMARC record value per line

Offline-check scope: SPF’s 10-term DNS lookup limit applies during evaluation across recursive includes/redirects; this tool counts only DNS-triggering terms written directly in this record, so it cannot prove compliance. It cannot determine the two-void-lookup condition, fetch included policies, verify DKIM key strength/ownership, consult the Public Suffix List, authorize external DMARC report destinations, or confirm DNS publication. Relaxed alignment below uses a clearly labeled last-two-label heuristic and can be wrong for suffixes such as co.uk. Zone-file quoting varies by DNS provider; copy the record value rather than zone syntax when your provider supplies separate name/type/value fields.