uCheckeruChecker

SPF Record Generator

Pick the services that send your mail and we will assemble a valid record — counting DNS lookups for real by expanding every include. You see the limit before you publish, not after SPF breaks.

Who sends mail as your domain

List every service that sends on your behalf: mailbox provider, marketing platform, transactional sender, CRM. A service you forget will start failing authentication.

Service (include)

Use ~all while rolling out, collect DMARC reports, and confirm every legitimate sender is listed. Then switch to -all.

0DNS lookups of the 10 allowed

Counted for real: every include is expanded together with whatever is nested inside it. This is the same count a receiving mail server will do.

Generated record

v=spf1 -all
How to publish it
TypeNameTTL
TXT@3600

Getting the record right

The first rule is to list everyone who sends as your domain. A service you forget is mail that starts failing authentication. People usually remember the mailbox provider and the marketing platform, then forget transactional mail from the application, CRM notifications, and the support desk replying from its own address.

The second rule is to leave nothing stale. An include left over from a service you no longer use burns one of your ten lookups and keeps authorisation with someone who should not have it.

About the ten-lookup limit

RFC 7208 permits at most ten DNS lookups per evaluation. The include, a, mx, ptr, exists mechanisms and the redirect modifier each cost one. ip4 and ip6 are free — no DNS query is involved.

Go over and evaluation returns permerror, which receivers treat as an SPF failure even though the record looks entirely normal. A counter showing eight or nine means the headroom is gone: one more service will break it.

Choosing a policy

  • -all — anything unlisted is rejected. The recommended end state.
  • ~all — marked suspicious but delivered. Sensible during rollout.
  • ?all — gives receivers no signal, so there is little point to it.
  • +all — authorises the entire internet. Deliberately not offered here: it is worse than having no SPF at all.

Questions

Nearby

Record ready — now check the list

SPF decides whether a receiver trusts the sender. Mail still will not arrive if the addresses are dead. uChecker cleans your list before you send — the first 100 addresses are free.

Check your list