---
title: New domain? How to create SPF and DMARC records with the SPF & DMARC Generator
description: You're setting up email on a domain that sends from several services, and you need the two TXT records that make receivers trust it. To create SPF and DMARC records, list every service that sends as your domain in one SPF record, keep it under 10 DNS lookups, and start DMARC at p=none with a report address. Here's how with the free SPF & DMARC Generator, using a real three-provider setup.
canonical: https://watchfor.io/blog/how-to-create-spf-and-dmarc-records
---

# New domain? How to create SPF and DMARC records with the SPF & DMARC Generator

2026-10-04 · WatchFor Team · Guides · guides, email, deliverability

You're setting up email on a domain that sends from several services, and you need the two TXT records that make receivers trust it. To create SPF and DMARC records, list every service that sends as your domain in one SPF record, keep it under 10 DNS lookups, and start DMARC at p=none with a report address. Here's how with the free SPF & DMARC Generator, using a real three-provider setup.

To create SPF and DMARC records, publish two TXT records. The SPF record goes
on the domain itself and lists every service allowed to send as you, for
example `v=spf1 include:_spf.google.com ~all`. The DMARC record goes on
`_dmarc.yourdomain` and starts in monitoring mode:
`v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain`. Two rules keep them
working: exactly one SPF record, and no more than 10 DNS lookups inside it.

The free [SPF & DMARC Generator](/spf-dmarc-generator) builds both records
from checkboxes and counts the lookups as you add providers. It runs in your
browser. No signup.

## What this tool answers

*What exactly do I paste into DNS for my providers?* Reach for it when you
set up a new domain, add or remove a sending service, move from one email
provider to another, or replace a hand-written SPF record you no longer
trust.

## A real example

### Creating SPF and DMARC records for a domain with three senders

A typical small SaaS: staff mail on Google Workspace, newsletters through
SendGrid, password resets and receipts through Mailgun. Each provider's
setup page says "add our include to your SPF record", and none of them
mentions the others. We built the records for `example.com`.

In the [SPF & DMARC Generator](/spf-dmarc-generator) we kept **Google
Workspace** (selected by default), ticked **SendGrid** and **Mailgun**, and
left the ending on `~all`:

![The SPF record panel of the SPF & DMARC Generator for example.com with Google Workspace, SendGrid and Mailgun ticked and ~all selected: the TXT record at example.com reads v=spf1 include:_spf.google.com include:sendgrid.net include:mailgun.org ~all, and an amber warning says Estimated DNS lookups: 8 of 10 allowed, close to the limit, adding another service may break SPF](/blog/how-to-create-spf-and-dmarc-records-spf.webp)

The generator produced one record:

```text
v=spf1 include:_spf.google.com include:sendgrid.net include:mailgun.org ~all
```

and an amber warning: **8 of 10** lookups. The three includes look like
three lookups, but each provider's include can contain more:

| Include | Lookups it costs |
| --- | --- |
| `_spf.google.com` | 1 (lists IP ranges only) |
| `sendgrid.net` | 2 (it includes `ab.sendgrid.net`) |
| `mailgun.org` | 5 (two includes, one of which has two more) |

For DMARC we kept policy **none**, typed `dmarc-reports@example.com` as the
report address and left pct at 100 and both alignments relaxed:

![The DMARC record panel of the generator: policy none (monitor only), aggregate reports to dmarc-reports@example.com, pct 100, DKIM relaxed and SPF relaxed, producing the TXT record at _dmarc.example.com: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com](/blog/how-to-create-spf-and-dmarc-records-dmarc.webp)

```text
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com
```

**The answer:** publish the SPF value as a TXT record on `example.com` (host
`@`) and the DMARC value as a TXT record on `_dmarc.example.com` (host
`_dmarc`). The setup works, with two lookups to spare: Mailgun alone uses
five, so a fourth service with a nested include could push the record over
the limit. Then enable DKIM in each of the three services, since the
generator doesn't create DKIM keys.

## How to read the results

| What you see | What it means |
| --- | --- |
| **Provider tiles** | Each adds that service's documented include. The grey text shows the exact `include:` added. |
| **Extra IPv4 / IPv6 senders** | Your own servers, as `ip4:`/`ip6:` terms. They cost no lookups. |
| **Other includes** | Includes for services not in the list. Each is counted as 1 lookup, but its own nested includes add more, so check them. |
| **Also authorise `a` / `mx`** | Lets the domain's own web or mail server IPs send. One lookup each; leave them off unless those servers really send mail. |
| **Policy for everyone else** | The ending: `-all` fail, `~all` softfail (the safe choice while rolling out), `?all` neutral (no protection). |
| **TXT record at …** | Where to publish it and the exact value, with **Copy record**. |
| **Estimated DNS lookups** | Grey up to 7, amber at 8–10 ("close to the limit"), red above 10 ("over the limit", receivers return `permerror`). |
| **DMARC policy / rua / pct / alignment** | `p=none` monitors, `quarantine` sends failing mail to spam, `reject` refuses it. `pct` is added only below 100; `adkim=s`/`aspf=s` only when you choose strict. |

## More ways to use it

- **Switching providers.** Rebuild the record with the new provider ticked
  and the old one unticked, rather than appending. Old includes that stay
  behind cost lookups and authorise servers you no longer use.
- **Merging two SPF records.** If a domain already has two `v=spf1`
  records, tick everything from both and publish one.
- **Moving DMARC forward.** After a few weeks of clean aggregate reports,
  come back, switch the policy to `quarantine` (optionally with a lower
  `pct` first), then `reject`.
- **Domains that don't send.** Untick everything and pick `-all`: the
  result, `v=spf1 -all`, plus a DMARC `p=reject`, stops anyone using the
  domain in phishing.

## Tips and gotchas

- **Replace, don't add.** If an SPF record exists, edit it to the new value.
  Two SPF records are a permanent error for the whole domain.
- **Count again later.** Providers change their own records; the counts in
  the generator were measured from the live records, and the
  [SPF guide](/blog/how-to-check-an-spf-record) shows how to recount with
  `dig`.
- **Start DMARC at `none`, but start it.** Jumping straight to `reject`
  bounces mail from any service you forgot. Without an `rua` address, you
  get no reports and have nothing to decide with.
- **DKIM comes from each provider.** The private key lives on their
  servers, so they give you the CNAME or TXT records to publish. Without
  aligned DKIM, mail forwarded by your recipients fails DMARC.
- **Check after publishing.** Run the
  [email authentication check](/email-policy-checker) on your domain, and
  the [DMARC Checker](/dmarc-record-checker) for the policy.

## Check it from the command line too

Once published, confirm both records are live:

```bash
dig +short @1.1.1.1 TXT example.com | grep spf1
dig +short @1.1.1.1 TXT _dmarc.example.com
```

For `example.com` itself (which sends no mail) this returns `"v=spf1 -all"`
and `"v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s"`, the parked-domain setup
described above. To see where the lookups hide, open each include:

```bash
dig +short @1.1.1.1 TXT mailgun.org | grep spf1
dig +short @1.1.1.1 TXT _spf.mailgun.org | grep spf1
dig +short @1.1.1.1 TXT sendgrid.net | grep spf1 | grep -o 'include:[^ "]*'
```

```text
"v=spf1 include:_spf.mailgun.org include:_spf.eu.mailgun.org -all"
"v=spf1 include:_spf1.mailgun.org include:_spf2.mailgun.org ~all"
include:ab.sendgrid.net
```

`include:mailgun.org` (1) pulls in two includes (2), and one of them two
more (2): five lookups for one provider.

## Keep watching it

Published records drift: someone adds a sender, a DNS migration drops
`_dmarc`, or a policy is relaxed during an incident and stays that way. An
[email monitor](/email-monitoring) (the email policy type) re-checks SPF and
DMARC on a schedule and fires **SPF Record Missing** or **DMARC Record
Missing** by default; **SPF Too Many DNS Lookups**, **Weak DMARC Policy**
and, with your selectors, **DKIM Record Missing** can be switched on.

## FAQ

**How do I create an SPF record?**
List every service that sends mail as your domain, add each one's
`include:` (and `ip4:` for your own servers) after `v=spf1`, end with
`~all` or `-all`, and publish it as a single TXT record on the domain.
Keep the total DNS lookups at 10 or fewer.

**What should my first DMARC record be?**
`v=DMARC1; p=none; rua=mailto:you@yourdomain`, published as TXT on
`_dmarc.yourdomain`. It blocks nothing but sends you daily reports of who
sends as your domain, which you need before enforcing.

**Can I have more than one SPF record?**
No. Two `v=spf1` records make SPF fail with a permanent error. Merge all
senders into one record. How the records work together is in
[SPF, DKIM and DMARC explained](/blog/spf-dkim-dmarc-explained).

---

Canonical page: https://watchfor.io/blog/how-to-create-spf-and-dmarc-records · All articles: https://watchfor.io/blog/all.md · Site guide: https://watchfor.io/llms.txt