Record generators
SPF record
Zone file (BIND)
Value only
Lookups are counted statically: each include, a, mx, exists and redirect is one, and every included record adds its own. Once published, check the real total on the Mail page. Publish exactly one SPF record per domain.
DKIM record
Name
Zone file (BIND)
Value only
Value split into 255-character strings
Private key · for the mail server only
PKCS#8 (BEGIN PRIVATE KEY)
PKCS#1 (BEGIN RSA PRIVATE KEY)
Public key (PEM)
OpenDKIM, Rspamd, Exim and Postfix setups accept either private key format. Keep the file mode at 600 (or 640 for the mail server's group).
DMARC record
Zone file (BIND)
Value only
Recommended rollout
p=nonewithrua=: collect reports for 2–4 weeks and make sure every service that sends as your domain passes SPF or DKIM with alignment.p=quarantine, optionally withpct=25→50→100: failing mail goes to spam while you watch the reports.p=reject: spoofed mail is refused. Keeprua=so you notice new senders.
DS records
Zone file (BIND), for the parent zone
Values only (key tag, algorithm, digest type, digest)
Give your registrar the SHA-256 record (digest type 2); SHA-384 (4) also works. SHA-1 (1) is deprecated. After the DS is published, check the chain on the DNSSEC page.
CAA records
Zone file (BIND)
Values only
issue allows a CA to issue certificates for the name, issuewild for wildcards only (it overrides issue for them), iodef is where CAs report refused requests. Without any CAA record every CA may issue.