Tagabuo at Tagasuri ng DKIM / SPF / DMARC

(Nasa Ingles ang dokumentasyon)

What it does

Email spoofing stays trivial until a domain publishes three DNS records that together prove who is allowed to send its mail. This tool builds those three records as ready-to-paste TXT values, one zone-file block per record:

• SPF (Sender Policy Framework, RFC 7208) — the TXT record at the zone apex listing the servers allowed to send mail for the domain. You edit the raw terms (mechanisms and qualifiers like include:, ip4:, ~all) one per line, exactly as they appear after v=spf1.
• DKIM (DomainKeys Identified Mail, RFC 6376) — the public key published at <selector>._domainkey.<domain>. Set the selector, key type (k=), hashes (h=), test mode (t=y), and paste the

  base64base64An encoding representing binary data as 64 safe ASCII characters, so it survives transport through text-only channels. It encodes — it does not encrypt.

  public key (p=) your mail provider generates.
• DMARC (RFC 7489) — the policy at _dmarc.<domain>: policy (p= none / quarantine / reject), subdomain policy (sp=), report addresses (rua= / ruf=), sampling (pct=), and alignment modes (adkim= / aspf= relaxed or strict).

The sticky output panel shows all enabled records separated by comments, live as you type. A validation layer flags the classic publishing mistakes before they reach DNS: a missing DKIM selector, more than one SPF record, an SPF record with no ~all/-all/redirect= terminator, a DMARC record with no p= policy, and a domain that is not a fully-qualified name.

How to use it

1. Pick a preset — Google Workspace, Microsoft 365, or Full enforcement — to start from a known-good shape, or paste your existing records into the import panel: SPF values (v=spf1 …), DKIM values (v=DKIM1; k=…; p=…), and DMARC values (v=DMARC1; p=…) — bare values or full zone lines. Names like _dmarc.example.com or selector1._domainkey.example.com are read to fill the domain and selector fields.
2. Set the domain and DKIM selector, then fill each record’s fields. Each record has an on/off switch; disabled records drop out of the output.
3. Copy or download dns-records.txt and publish each block as a TXT record at your DNS provider.

Everything lives in the URL — share a link and the recipient sees your exact configuration.

Examples

A Google Workspace domain at monitor stage:

; SPF — TXT at example.com (the zone apex; often written "@")
example.com. IN TXT "v=spf1 include:_spf.google.com ~all"

; DKIM — TXT at google._domainkey.example.com
google._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; h=sha256; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A…"

; DMARC — TXT at _dmarc.example.com
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com; adkim=r; aspf=r"

What the validation layer catches as you edit:

• SPF terms without a terminal rule → “SPF needs ~all / -all or redirect=” — unmatched senders get a Neutral result.
• Two v=spf1 records pasted together → “Multiple SPF records” — receivers treat this as a permanent error and ignore SPF for the whole domain.
• DMARC with no policy chosen → “DMARC p= policy missing”.
• Domain field holding localhost → “Not a fully-qualified domain”.

Good to know

• The p= key comes from your provider. DKIM keys are generated per domain by the sending service (Google Admin console, Microsoft Defender, Mailgun, …). The builder leaves p= empty until you paste it — an empty p= publishes as a revoked key, so fill it before going live.
• Roll out DMARC in the standard order: p=none + rua= → study the aggregate reports → quarantine (optionally pct= below 100) → reject. p=reject without working SPF/DKIM blocks your own mail.
• One SPF record, one DKIM record per selector, one DMARC record — duplicates are permanent errors at receivers, not merge requests.
• Fully client-side. The builder never queries DNS and sends nothing anywhere; only the share URL leaves the page, and only when you copy it.
• Related tools: WHOIS /

  RDAPRDAPThe modern JSON REST protocol for WHOIS-style registration data (domains, nameservers, entities), replacing the legacy plain-text WHOIS protocol.Learn more

  Lookup (who owns the domain), Defang/Refang,

  HashHashA one-way function that maps data of any size to a fixed-length digest. Same input, same digest; any change, different digest; not reversible.

  Generator.