Record builders

The SPF builder, DMARC record generator, and CAA record builder turn structured inputs into draft records alongside DKIM, Microsoft 365, and LOC builders. A builder edits only your unsaved draft: you still review its output, save, preview, and push before any provider changes.

Use a builder#

A blank TTL uses the zone's Default TTL; when neither is set, the DNSControl-compatible default is 300 seconds. Label is relative to the zone, and @ means the zone apex.

How to use the SPF builder#

SPF_BUILDER creates one TXT record and can resolve and flatten selected include: or redirect= targets. When flattening is enabled, it also keeps the unmodified policy at Raw record label. Test a policy below, then read how to diagnose and fix the SPF 10-lookup limit.

Suppose _spf.example.net resolves to v=spf1 ip4:192.0.2.0/24 -all. With SPF parts set to v=spf1, include:_spf.example.net, -all, and Includes to flatten set to *, the result is:

@        300 TXT "v=spf1 ip4:192.0.2.0/24 -all"
_rawspf  300 TXT "v=spf1 include:_spf.example.net -all"

SPF_BUILDER({
  label: "@",
  parts: ["v=spf1", "include:_spf.example.net", "-all"],
  flatten: ["*"],
  ttl: 300,
})

The parser accepts a, mx, include, redirect, exists, ptr, ip4, ip6, and a terminal all, including qualifiers. Resolution errors, multiple or missing included SPF records, include loops, and unsupported mechanisms leave the record unflattened and produce a warning. The builder counts nested DNS lookups after resolution, adds one lookup for each overflow link, and warns above the RFC 7208 limit of 10. A split pattern without %d also warns and leaves the policy unsplit. See Lint and validation for the checks that continue to run on the draft.

DMARC record generator#

DMARC_BUILDER emits one TXT record at _dmarc or _dmarc.<label>.

_dmarc  300 TXT "v=DMARC1; p=reject; sp=quarantine; adkim=s; aspf=r; rua=mailto:dmarc@example.com; ruf=mailto:fail@example.com; fo=1"

DMARC_BUILDER({
  policy: "reject",
  subdomainPolicy: "quarantine",
  alignmentDKIM: "s",
  alignmentSPF: "r",
  rua: ["mailto:dmarc@example.com"],
  ruf: ["mailto:fail@example.com"],
  failureOptions: "1",
})

Invalid policies, alignments, percentages, URIs, failure options, formats, public-suffix values, or test-mode values stop generation.

CAA record builder#

CAA_BUILDER combines all values at one owner into a CAA record set. A checked critical field uses flag 128; otherwise it uses 0.

@  600 CAA 0 issue "letsencrypt.org"
@  600 CAA 0 issuewild ";"
@  600 CAA 128 iodef "mailto:security@example.com"

CAA_BUILDER({
  label: "@",
  issue: ["letsencrypt.org"],
  issuewild: ["none"],
  iodef: "mailto:security@example.com",
  iodef_critical: true,
  ttl: 600,
})

At least one of issue, issuewild, issuevmc, or issuemail must contain a value; iodef alone is not enough.

DKIM builder#

DKIM_BUILDER creates a TXT record at <selector>._domainkey, optionally under another label.

mail._domainkey  300 TXT "v=DKIM1; h=sha256; k=rsa; p=MIGfExample; s=email; t=s"

DKIM_BUILDER({
  selector: "mail",
  pubkey: "MIGfExample",
  keytype: "rsa",
  hashtypes: ["sha256"],
  servicetypes: ["email"],
  flags: ["s"],
})

An unsupported version, key type, hash for that key type, service, or flag stops generation.

Microsoft 365 builder#

M365_BUILDER generates Microsoft 365 service records. It uses the zone default TTL because this form has no TTL field.

@                    300 MX    0 example-com.mail.protection.outlook.com.
autodiscover         300 CNAME autodiscover.outlook.com.
selector1._domainkey 300 CNAME selector1-example-com._domainkey.example.onmicrosoft.com.
selector2._domainkey 300 CNAME selector2-example-com._domainkey.example.onmicrosoft.com.

M365_BUILDER("example.com", {
  initialDomain: "example.onmicrosoft.com",
})

Turn off unwanted defaults before previewing. The builder validates the two DKIM prerequisites described above; it does not contact Microsoft to discover your tenant values.

LOC builders#

All four LOC builders emit one LOC record with altitude defaulting to 0 meters and size, horizontal precision, and vertical precision set to 0.00m. Label defaults to @; Altitude (m) and TTL are optional.

Decimal degrees#

Latitude (decimal degrees) and Longitude (decimal degrees) are required. Negative values become south and west.

white-house  300 LOC 38 53 51.940 N 77 02 11.580 W 19m 0.00m 0.00m 0.00m

LOC_BUILDER_DD({ label: "white-house", x: 38.89775977858357, y: -77.03655125982903, alt: 19 })

Degrees and decimal minutes#

Coordinates is required and must contain latitude with N or S and longitude with E or W.

@  300 LOC 25 14 24.000 S 153 09 0.000 E 3m 0.00m 0.00m 0.00m

LOC_BUILDER_DMM_STR({ str: "25.24°S 153.15°E", alt: 3 })

Degrees, minutes, and seconds#

Coordinates accepts typographic symbols, ASCII quotes, or letter separators.

opera  300 LOC 33 51 31.000 S 151 12 51.000 E 4m 0.00m 0.00m 0.00m

LOC_BUILDER_DMS_STR({ label: "opera", str: "33°51′31″S 151°12′51″E", alt: 4 })

Any coordinate format#

Coordinates is required. This builder tries decimal-minutes parsing first, then degrees-minutes-seconds parsing.

geyser  300 LOC 44 27 38.000 N 110 49 41.000 W 2240m 0.00m 0.00m 0.00m

LOC_BUILDER_STR({ label: "geyser", str: "44.46046°N 110.82815°W", alt: 2240 })

Malformed coordinates or latitude/longitude outside DNS LOC bounds stop generation. The decimal-degrees implementation also rejects the exact coordinate 0, 0; use one of the string LOC builders for that point. Review provider support in Record types before pushing a LOC record.