SPF Record Generator
Pick the services that send your mail and we will assemble a valid record — counting DNS lookups for real by expanding every include. You see the limit before you publish, not after SPF breaks.
Who sends mail as your domain
List every service that sends on your behalf: mailbox provider, marketing platform, transactional sender, CRM. A service you forget will start failing authentication.
Use ~all while rolling out, collect DMARC reports, and confirm every legitimate sender is listed. Then switch to -all.
Counted for real: every include is expanded together with whatever is nested inside it. This is the same count a receiving mail server will do.
Generated record
v=spf1 -all| Type | Name | TTL |
|---|---|---|
| TXT | @ | 3600 |
Getting the record right
The first rule is to list everyone who sends as your domain. A service you forget is mail that starts failing authentication. People usually remember the mailbox provider and the marketing platform, then forget transactional mail from the application, CRM notifications, and the support desk replying from its own address.
The second rule is to leave nothing stale. An include left over from a service you no longer use burns one of your ten lookups and keeps authorisation with someone who should not have it.
About the ten-lookup limit
RFC 7208 permits at most ten DNS lookups per evaluation. The include, a, mx, ptr, exists mechanisms and the redirect modifier each cost one. ip4 and ip6 are free — no DNS query is involved.
Go over and evaluation returns permerror, which receivers treat as an SPF failure even though the record looks entirely normal. A counter showing eight or nine means the headroom is gone: one more service will break it.
Choosing a policy
-all— anything unlisted is rejected. The recommended end state.~all— marked suspicious but delivered. Sensible during rollout.?all— gives receivers no signal, so there is little point to it.+all— authorises the entire internet. Deliberately not offered here: it is worse than having no SPF at all.
Questions
Nearby
Record ready — now check the list
SPF decides whether a receiver trusts the sender. Mail still will not arrive if the addresses are dead. uChecker cleans your list before you send — the first 100 addresses are free.
Check your list