Mail Record Generator
Enter your domain and pick a record type to generate a standards-correct, copy-paste DNS record for mail authentication and transport security — SPF, DMARC, DKIM, MTA-STS, TLS-RPT or BIMI — with the exact DNS name to publish it at and the steps to roll it out safely. Start here, then run the matching checker to confirm it's live.
Reviewed by the SysGlass team · Updated July 21, 2026
What it checks
- Generates an SPF record (v=spf1 mx -all) you extend with your senders
- Generates a DMARC record starting at p=none with rua reporting, for a safe rollout to p=reject
- Gives the DKIM DNS name + record shape and the key-generation commands
- Generates the MTA-STS TXT record AND the .well-known policy file contents
- Generates TLS-RPT and BIMI records with the correct names and values
How to read the result
- Record name = the DNS name to create the record at (e.g. _dmarc.yourdomain.com).
- Type = TXT for all of these (MTA-STS also needs a hosted policy file).
- Value = paste this as the record content, then customise for your own senders.
- Follow the steps, publish, then run the matching SysGlass checker (SPF/DMARC/DKIM/…) to verify.
Frequently asked questions
Is the generated SPF record complete?
It's a safe starting point (v=spf1 mx -all) that authorizes your own MX. Add each third-party sender (your ESP, marketing tool, etc.) as ip4:/ip6:/include: before -all, keeping total DNS lookups at or below 10.
Why does the DMARC record start at p=none?
p=none is monitor-only — it collects reports without affecting delivery. Read the reports until every legitimate sender passes, then move to p=quarantine and finally p=reject. Going straight to reject can block your own mail.
Can it generate my DKIM key?
It gives the DNS record shape and the exact name, plus the opendkim/openssl commands to generate a 2048-bit (or Ed25519) key. The private key stays on your server; you publish only the public key.
What about MTA-STS — isn't that more than a DNS record?
Yes — the generator gives both the _mta-sts TXT record AND the contents of the policy file you host at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt over a valid certificate.