This tool runs entirely in your browser. Nothing you enter is sent anywhere — it's just building a text record from the options you tick. No analytics, no tracking, no calls back to our servers.
An SPF record is a single TXT record that lists which mail servers are allowed to send email as your domain. Get it right and forged mail claiming to be from you gets rejected. Get the syntax wrong, or blow past the 10-lookup limit, and it silently fails to protect anything — or worse, breaks your own legitimate mail. This tool builds the record for you and flags the lookup-limit problem before it bites you. For the full picture of how SPF fits with DKIM and DMARC, see SPF, DKIM and DMARC explained.
1. Who sends mail for your domain?
These are each provider's commonly published SPF include host as of general knowledge — providers occasionally change them, so confirm against the provider's own current SPF setup page before publishing, especially if this record protects a live domain.
2. What should happen to mail that fails the check?
~all tells receiving servers to accept but flag/quarantine mail that fails the check — the safer default while you're confirming every legitimate sender is actually covered. -all tells them to reject it outright, which is the stronger setting but only safe once you're confident nothing legitimate is missing from the record above.
3. Your record
How to add this to your DNS
Add it as a TXT record on the bare domain (usually shown as @ in your DNS provider's panel) with the value shown above. If you already have an SPF record, don't add a second one — only one v=spf1 TXT record is allowed per domain, so merge the mechanisms into your existing record instead. For a full walkthrough of DNS record types, see DNS records explained.
Why the 10-lookup limit matters
Every include, a, mx, ptr, exists, and redirect mechanism costs one DNS lookup when a receiving mail server evaluates your SPF record — and some of those, like include, can nest further lookups inside them. The SPF standard caps this at 10 lookups total. Exceed it and the entire check returns a permerror, which many mail servers treat as an outright fail — the opposite of what you wanted. ip4, ip6, and all don't cost a lookup, which is why adding a mail server by its IP address (rather than by hostname) is the cheaper option when you have a choice.
Not sure your SPF record is actually working? Our DNS record checker looks up your live SPF, DMARC, and DKIM records and flags common problems — including this exact lookup-limit issue.
Check my DNS →