Free tool
SPF and DMARC record generator
Bought a separate domain for outreach? Before it sends a single pitch, it needs SPF and DMARC records. Pick your mail provider and policy, then copy the host and value straight into your DNS.
Use an inbox you read, ideally on your main domain.
SPF record
- Type
- TXT
- Host
- @ (the root of the domain)
- Value
DMARC record
- Type
- TXT
- Host
- _dmarc
- Value
Don't forget
- DKIMGenerate it in your mail provider and publish the TXT record they give you.
- MXAdd your provider's MX record so replies reach you.
- WebsitePoint the domain at a page (or redirect it to your main site) so people who check it see a real company.
Why outreach goes from a separate domain
Cold outreach gets a share of spam complaints even when every pitch is relevant. If those complaints land on your main domain, they can drag
down the deliverability of your password resets, invoices and customer emails. A second domain, like getyourbrand.com, keeps
that risk away from your business email. It needs its own SPF, DKIM and DMARC, its own mailbox, and a slow ramp-up before it sends at full volume.
Read the full deliverability guide for link outreach, or plan the ramp with the mailbox warmup calculator. On a paid BacklinkGenie plan, we register the domain, publish these records and ramp the mailbox for you.
Sending from Google Workspace? Our guide to Workspace setup and limits for outreach covers the DKIM key and daily caps. When the records are live, confirm them with the SPF, DKIM and DMARC checker.
Questions people ask
What do SPF, DKIM and DMARC actually do?
SPF lists which servers may send mail for your domain. DKIM adds a signature that proves the message wasn't altered and came from your domain. DMARC tells receiving servers what to do when a message fails those checks, and where to send reports. Gmail and Yahoo require all three for anyone sending in volume, and they help any outreach domain land in the inbox.
Where do I add these records?
In the DNS settings of the domain you send from, at your registrar or DNS host (Cloudflare, Porkbun, Namecheap and so on). SPF is a TXT record on the root of the domain, shown as @. DMARC is a TXT record on the host _dmarc. Each domain can have only one SPF record, so merge providers into it rather than adding a second.
Which DMARC policy should a new outreach domain use?
Start with p=none and a reporting address for the first week or two, so you can see that legitimate mail passes. Then move to p=quarantine. Use p=reject once you're sure nothing legitimate fails. A brand-new outreach domain that sends only from one provider can usually reach quarantine quickly.
What's the 10 DNS lookup limit?
SPF allows at most 10 DNS lookups when a receiver evaluates your record. Each include, a, mx and redirect counts, and so do includes nested inside them. Past 10, SPF fails. The tool counts your top-level lookups; providers like Google use a few internally, so keep your list short.
How do I get a DKIM record?
Your mail provider generates it, because they hold the private key. In Google Workspace it's under Apps, Gmail, Authenticate email. In Microsoft 365 it's in the Defender portal under DKIM. You publish the TXT value they give you. This tool doesn't generate DKIM keys.
Related
Mailbox warmup calculator
See how many days a new outreach mailbox needs to reach full volume, and how many pitches a month you can send across several mailboxes.
Outreach subject line tester
Score a pitch subject line for length, mobile truncation, spam triggers, clickbait and whether it names the editor's post.
Outreach volume planner
Start from the number of links you want a month and work back to pitches, prospects and mailboxes, including warmup time.
See which posts you could be in.
Paste your URL. The agent finds posts in your niche where your product fits and the editor to contact for each. Free, no card.
