Record Studio

Record Studio builds correct SPF, DKIM, DMARC, BIMI, TLSA/DANE, MTA-STS, TLS-RPT, CAA, SMIMEA, security.txt and Null MX records — and does more than generate them: load a record you already publish and it is validated in place, colour-graded and with the certificate details behind it, using the same rules as the free domain security check. New to these records? The email authentication and mail server TLS & DANE guides explain what each one does and how it is scored.

All generators run entirely in your browser; key pairs and certificate digests are computed locally with the Web Crypto API, and nothing you type into a generator – IP addresses, certificates or freshly generated DKIM private keys – ever leaves your device. The one exception is the optional "Load current record" button: it sends only the domain you want to read to our server, which looks it up in public DNS (over HTTPS for security.txt and MTA-STS) – just like a scan – and returns it. The TLSA generator's "Fetch certificate from your server" button additionally has our server open a TLS connection to the host and port you enter, to read that server's public certificate (it never sees a private key). Internationalized domain names with non-ASCII characters are converted to their punycode A-label form, because DNS records must use it.