Perimetry Cloud
FRDEStart free
Product
Resources
Pricing
FrançaisDeutschSign inStart free

Free tools

DNS record generators

Write the records that protect a domain’s e-mail and certificates, one setting at a time, with what each one does. Copy them into your DNS provider.

For one record with its own explanations and common mistakes, use the SPF record generator or the DMARC record generator.

SPF lists the servers allowed to send mail for your domain. Tick every service that sends mail with your address: your mailbox, newsletters, invoicing, helpdesk.

Services that send your mail
Mail from other servers

DMARC tells receivers what to do with mail that claims to come from your domain but fails SPF and DKIM, and where to send their daily reports.

Legacy setting: pct (RFC 7489)

CAA names the authorities allowed to issue certificates for your domain. Any other authority must refuse. List every one your host, CDN or e-mail provider uses, or renewals will fail.

Authorities allowed

MTA-STS asks other mail servers to always encrypt the mail they send you, and to check your certificate. It takes a TXT record and a small file served over HTTPS at mta-sts.your-domain. TLS-RPT sends you reports when it fails.

security.txt tells people who find a vulnerability how to reach you (RFC 9116). Serve it at /.well-known/security.txt on your website.

Then make sure it stays that way

Perimetry Cloud checks these records every day or week, tells you when one changes or breaks, and applies fixes in Cloudflare in one click.

Start free Check a domain