Which records do I actually need to send email?

At minimum an A record for the sending host, one SPF TXT record authorising the sending IP, a DKIM TXT record publishing your public signing key, a DMARC TXT record at _dmarc, and a PTR record for reverse DNS. An MX record is strongly recommended even on a send-only domain, because a domain that cannot receive bounces looks suspicious to receivers.

Why is the DKIM value a placeholder?

The public key in a DKIM record is one half of a key pair whose private half must stay on your mail server. Generating the pair in a web page would mean the private key had existed outside your server, so this tool emits a placeholder instead. Generate the pair on the server — PowerMTA does this during setup — then paste the public key over the placeholder.

Where do I set the PTR record?

Not with your DNS provider. Reverse DNS for an IP is controlled by whoever owns the IP block, which means your hosting or cloud provider. Linode, DigitalOcean, Vultr and AWS all expose it in their control panel, usually as "reverse DNS" or "RDNS" on the instance. The PTR should resolve to the same hostname as your A record.

Should I use ~all or -all in SPF?

Start with ~all (softfail) while you confirm every legitimate service that sends for the domain is listed, then switch to -all (hardfail). Going straight to -all risks silently destroying mail from a service you forgot about, and that failure is hard to diagnose because the mail simply never arrives.

What TTL should these records use?

The generator uses 300 seconds. A short TTL is deliberate while you are setting up, because it means a mistake propagates out again in five minutes rather than a day. Once the records are stable and verified you can raise the TTL to an hour or more to reduce lookup load.

Can something create these records for me?

Yes. PMTAcore creates them directly through the Cloudflare, GoDaddy and Namecheap APIs as part of installing PowerMTA, including generating the real DKIM key pair on the server and detecting records that would conflict with the ones it is about to add.

Free tool — no signup required

Free DNS Record Generator for Email Sending

Enter your sending hostname and server IP to generate a complete, copy-paste-ready DNS record set — with an explanation of what each record does and where it goes.

The records a sending host needs

Standing up a new mail server is mostly a DNS exercise. The software will happily send mail the moment it is installed, but until DNS says the server is allowed to send for your domain, receivers have no reason to believe any of it. Six records do the work, and getting any one of them wrong produces a delivery problem that looks like a mystery until you check DNS.

A — resolves your sending hostname to the server's IP. Receivers look this up when validating the hostname your server announces in its SMTP greeting.
SPF — a TXT record authorising the sending IP. Without it, mail from your server is unauthenticated by default.
DKIM — a TXT record publishing the public half of your signing key, so receivers can verify signatures your server adds to outgoing mail.
DMARC — a TXT record at _dmarc telling receivers how to treat mail that fails both SPF and DKIM, and where to send reports.
MX — lets the domain receive mail, which matters because bounce handling and DMARC reports both need somewhere to arrive.
PTR — reverse DNS for the IP. This is the one record you cannot set at your DNS provider, and the one most often missing.

Why DKIM comes with a placeholder

A DKIM record publishes the public half of an asymmetric key pair. The private half signs your outgoing mail and must never leave the server. Any web tool offering to generate the pair for you has, by definition, held your private key — so this generator emits a placeholder value instead and leaves the key generation on your server, where it belongs. PowerMTA generates the pair during setup; take the public key it produces and substitute it for the placeholder.

Note where the DKIM record is placed. DKIM is published on the registrable domain rather than the sending subdomain, so a sending host of mail.example.co.uk gets its DKIM record at default._domainkey.example.co.uk, not at default._domainkey.mail.example.co.uk. Compound suffixes like co.uk are handled correctly by the generator, which is a common source of hand-written mistakes.

Reverse DNS is set at your host, not your registrar

The single most common gap on a new sending server is a missing PTR record. Because reverse DNS is delegated to whoever owns the IP block, you set it in your cloud provider's control panel rather than alongside your other records. Linode, DigitalOcean, Vultr and AWS all expose it per-instance. Set it to the same hostname as your A record so the forward and reverse lookups agree — receivers check for that consistency, and several blacklists list IPs with no PTR at all.

Start permissive, then tighten

The generator defaults to SPF softfail and DMARC p=none because that combination cannot break anything while you are still discovering which services send mail as your domain. It is a starting point, not a destination. Once DMARC reports show only legitimate senders passing, move DMARC to p=quarantine and then p=reject, and switch SPF to hardfail. Doing it in that order means every change is reversible and you always know which change caused a difference.

After publishing, verify what actually resolved with the SPF, DKIM and DMARC checker — DNS providers occasionally mangle long TXT values, and a record that looks right in the control panel can resolve incorrectly. Then confirm the server is reachable with the SMTP server test and that its IP is clean with the blacklist checker.

Having this done for you

PMTAcore does all of the above as part of installing PowerMTA: DNS automation generates the real DKIM key pair on the server, creates every record through the Cloudflare, GoDaddy or Namecheap API, detects existing records that would conflict, and verifies propagation before declaring the host ready. See PowerMTA management or start on the free trial.

Frequently asked questions

Which records do I actually need to send email?: At minimum an A record for the sending host, one SPF TXT record authorising the sending IP, a DKIM TXT record publishing your public signing key, a DMARC TXT record at _dmarc, and a PTR record for reverse DNS. An MX record is strongly recommended even on a send-only domain, because a domain that cannot receive bounces looks suspicious to receivers.
Why is the DKIM value a placeholder?: The public key in a DKIM record is one half of a key pair whose private half must stay on your mail server. Generating the pair in a web page would mean the private key had existed outside your server, so this tool emits a placeholder instead. Generate the pair on the server — PowerMTA does this during setup — then paste the public key over the placeholder.
Where do I set the PTR record?: Not with your DNS provider. Reverse DNS for an IP is controlled by whoever owns the IP block, which means your hosting or cloud provider. Linode, DigitalOcean, Vultr and AWS all expose it in their control panel, usually as "reverse DNS" or "RDNS" on the instance. The PTR should resolve to the same hostname as your A record.
Should I use ~all or -all in SPF?: Start with ~all (softfail) while you confirm every legitimate service that sends for the domain is listed, then switch to -all (hardfail). Going straight to -all risks silently destroying mail from a service you forgot about, and that failure is hard to diagnose because the mail simply never arrives.
What TTL should these records use?: The generator uses 300 seconds. A short TTL is deliberate while you are setting up, because it means a mistake propagates out again in five minutes rather than a day. Once the records are stable and verified you can raise the TTL to an hour or more to reduce lookup load.
Can something create these records for me?: Yes. PMTAcore creates them directly through the Cloudflare, GoDaddy and Namecheap APIs as part of installing PowerMTA, including generating the real DKIM key pair on the server and detecting records that would conflict with the ones it is about to add.

More free email tools

Email Validator

Check any email address for syntax errors, typos, disposable domains, role accounts and missing MX records.

Blacklist Checker

Check any sending IP against dozens of DNSBL registries including Spamhaus, Barracuda and SpamCop.

SPF / DKIM / DMARC Checker

Look up a domain’s sender authentication records and get plain-English guidance on what to fix.

SMTP Server Test

Test whether an SMTP server answers on port 25, 587, 465 or 2525 and see the TLS and AUTH it advertises.

Run this at scale in PMTAcore

The desktop app runs dns record generator in bulk across every server you manage, keeps a full history, and exports results — alongside one-click PowerMTA installation, DNS automation and campaign sending.

Start Free Trial View Pricing See the feature