Bitelio
§ T-11  —  Tool← All tools

SPF, DMARC & DKIM
record generator

Build the three DNS records that authenticate your email — assemble your SPF policy, compose a DMARC record, and generate a real DKIM keypair right in your browser. Nothing is sent to a server.

Enter the domain without http:// or www.

SPF record builder
Include mechanisms

Add the include your provider gives you, e.g. _spf.google.com or amazonses.com.

None added yet.

IPv4 addresses

None added yet.

IPv6 addresses

None added yet.

Default for everyone else (all)

Host / Name

@

@ = the root of your domain

Type

TXT

SPF · TXT record
v=spf1 -all
§ 01The three records

What each record does.

SPF, DKIM and DMARC work together — publish all three to protect your domain and your inbox placement.

SPF authorizes senders

A TXT record listing every server allowed to send mail for your domain. Receivers check the sending IP against it and fail anything that isn't listed.

DKIM signs each message

Your mail server signs outgoing mail with a private key; receivers verify the signature against the public key you publish in DNS — proof the message wasn't altered in transit.

DMARC ties it together

DMARC checks that SPF and DKIM align with the visible From address, tells receivers what to do with mail that fails, and sends you reports so you can watch who is sending as you.

Skip the DNS wrangling.

Bitelio sets up SPF, DKIM and DMARC for your domain automatically, then watches your sending reputation around the clock. Free to start — no credit card required.

Start with BitelioWhat is SPF?What is DMARC?What is DKIM?

Frequently asked questions

Is my DKIM private key sent to any server?

No. The keypair is generated entirely in your browser using the WebCrypto API, and the private key never leaves your device — there is no network request. Copy it straight from this page onto your mail server, then close the tab. For that reason we cannot recover a key for you: if you lose it, simply generate a fresh keypair and republish the new public record.

What key size does the DKIM generator use?

It generates a 2048-bit RSA key, the modern standard recommended by RFC 8301. 1024-bit keys are considered weak and are increasingly rejected, while 4096-bit public keys can be too long for a single DNS TXT string and need splitting — 2048 bits is the sweet spot that virtually every provider accepts.

In what order should I publish these records?

Publish SPF and DKIM first and confirm your legitimate mail passes both, then add DMARC starting at p=none so you only monitor. Once your reports show authenticated mail aligning correctly, ramp the policy up to quarantine and finally reject. Turning on a strict DMARC policy before SPF and DKIM are solid will send your own mail to spam.

Where do I put the Host / Name value?

Each record has a specific host. SPF goes on the root of your domain (shown as @). DMARC goes on _dmarc.yourdomain.com. DKIM goes on selector._domainkey.yourdomain.com, using the selector you chose. Your DNS provider may append the domain automatically, so enter only the prefix if the full name would otherwise be duplicated.

Do I have to set all this up by hand?

No. If you send through Bitelio, domain authentication is guided end to end: SPF and DMARC are generated for you and DKIM signing is managed automatically with keys rotated on your behalf. This generator exists for teams running their own mail servers who need to produce and install the records themselves.