Free SPF, DMARC and security header generator

SPF: who can send email as you?

Tick every system that sends email from your domain: mailbox, newsletter, shop, help desk. A domain can only have one SPF record, so we put them all into one.

Your own server The website’s server sends email too (forms, order confirmations) My mail server sends too (cPanel, own server) Other IP addresses (separated by spaces)

Anything not on the list ~all: suspicious but let through (recommended with DMARC) -all: reject

Name (Host)
Type: TXT
Value

If you already have an SPF record, replace it with this one; don’t add a second.

DMARC: what should happen to forged email?

DMARC tells mailbox providers what to do with mail that claims to be from you but fails the checks. Start by monitoring, and tighten once the reports look clean.

Policy p=none: monitor only (first 2-4 weeks) p=quarantine: send to spam p=reject: refuse outright (the goal)

Subdomains Strict alignment (exact domain match only) Send me the daily summary report (optional)

If reports go to a different domain, that domain has to allow receiving them.

Name (Host)
Type: TXT
Value

Security headers for your website

These headers speak to the browser: only load the site over HTTPS, don’t let other sites frame it, don’t guess file types. Paste them into your server settings.

Server Apache (.htaccess) Nginx

Security headers for your website HTTPS only (HSTS, 1 year) subdomains too preload (only if every subdomain runs on HTTPS) Don’t guess file types (nosniff) Other sites can’t frame it (against clickjacking) Don’t pass the full address to other sites (Referrer-Policy) Block camera, microphone and location (Permissions-Policy)

A Content-Security-Policy is different for every site, so we don’t write one blind: set wrong, it breaks the site.

Record builder: SPF, DMARC, security headers

SPF: who can send email as you?

DMARC: what should happen to forged email?

Security headers for your website

Set it up? Check it.

We can set it up for you