DMARC, SPF & DKIM Email Security Record Auditor & Generator

SPF (Sender Policy Framework) declares which IP addresses and mail servers are authorized to send email on behalf of your domain. DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to outbound messages, allowing receivers to verify that the email originated from your domain and was not altered in transit. DMARC (Domain-based Message Authentication) ties SPF and DKIM together by enforcing domain alignment and instructing recipient mail servers (Gmail, Outlook, Yahoo) how to treat messages that fail authentication (none, quarantine, or reject).

DMARC requires "Identifier Alignment." It is not enough for an email to pass SPF under a technical envelope Return-Path (e.g. sendgrid.net); the domain shown to the user in the visible "From:" header must match or align with the authenticated domain. If you do not configure custom DKIM domain keys for third-party email service providers (ESPs), DMARC alignment will fail and your emails may be marked as spam.

RFC 7208 limits SPF evaluations to a maximum of 10 DNS lookups (triggered by include:, a, mx, ptr, and redirect mechanisms) to protect mail servers from DoS amplification attacks. If your SPF record chains multiple external services (e.g., Google Workspace + Zendesk + HubSpot + SendGrid), total lookups can easily exceed 10. Once this occurs, receiving servers abort evaluation with a "PermError" (Permanent Error), causing deliverability to crash.

A policy of p=none is strictly an observational monitoring mode. Recipient servers continue delivering unauthorized or spoofed emails to recipients while only dispatching aggregate XML reports to your rua email. To protect your brand from phishing and CEO impersonation, you must graduate your policy to p=quarantine (send unauthenticated mail to spam) and ultimately p=reject (block unauthorized mail at the gateway).

Yes. Key generation runs 100% locally in your browser memory using the W3C Web Crypto API (SubtleCrypto RSASSA-PKCS1-v1_5). Your private keys are never transmitted to any server or logged over the network. Once you close or reload the page, all in-memory keys are purged.