Record Studio

Record Studio builds correct SPF, DKIM, DMARC, BIMI, TLSA/DANE, MTA-STS, TLS-RPT, CAA, SMIMEA, security.txt and Null MX records — and does more than generate them: load a record you already publish and it is validated in place, colour-graded and with the certificate details behind it, using the same rules as the free domain security check. New to these records? The email authentication and mail server TLS & DANE guides explain what each one does and how it is scored.

All generators run entirely in your browser; key pairs and certificate digests are computed locally with the Web Crypto API, and nothing you type into a generator – IP addresses, certificates or freshly generated DKIM private keys – ever leaves your device. The exception is looking up what is already published. "Load current record" sends the name that has to be looked up to our server – the domain, plus the selector where you entered one (DKIM, BIMI), the host, port and protocol (TLSA), or the hashed local part of the address (SMIMEA; the hash is computed in your browser, and for a common local part it is guessable) – and the server looks it up in public DNS, or fetches it over HTTPS for security.txt and MTA-STS, just like a scan. Three of those go further: the TLSA generator has our server open a TLS connection to the host and port you enter – both from "Load current record" (TCP transports only) and from "Fetch certificate from your server" – to read that server's public certificate (it never sees a private key); and when the BIMI generator loads a record that is not a declination, our server also fetches the logo and the mark certificate from the URLs named inside that record. Internationalized domain names with non-ASCII characters are converted to their punycode A-label form, because DNS records must use it.