← jwatte.com

DNS Records Generator

Enter your domain + email configuration. Emits SPF, DKIM, DMARC, MX, CAA, BIMI, and DNSSEC-ready records in five provider syntaxes: Cloudflare (dashboard + API/Terraform), DigitalOcean (doctl + dashboard), AWS Route53 (CLI JSON + Terraform), Google Cloud DNS (gcloud + YAML), and a generic BIND zone file.

Audit your current records first → · Deep-dive blog →

1. Domain + identity

Domain (apex)

Primary org email (DMARC rua)

2. Email provider (for MX + SPF baseline)

Pick your sending provider. The tool pre-fills SPF include, MX hosts, and DKIM selector names for the ones it knows about. If "Custom / self-hosted," you'll fill the fields yourself.

3. Optional layers

CAA records (certificate authority authorization)

Restricts which CAs can issue certs for your domain. Includes Let's Encrypt + ZeroSSL by default.

BIMI (brand logo in Gmail/Yahoo inbox)

Requires DMARC with p=quarantine or p=reject AND a VMC certificate (paid). Enable only if you have both.

MTA-STS + TLS-RPT (inbound mail TLS policy)

Tells senders to require TLS when delivering mail to your domain. Near-zero downside, real anti-spoofing value.

DNSSEC notes + DS record template

Emits the DS record format your registrar needs, plus the per-provider steps to enable DNSSEC signing.

DMARC enforcement (p=reject, not p=none)

Default is p=none (monitor only). Check this when you've watched rua reports for 2-4 weeks and confirmed every legitimate sender is aligned.