SPF Record Generator

An SPF (Sender Policy Framework) record is a DNS TXT record that specifies which mail servers and IP addresses are authorised to send email on behalf of your domain. When a receiving mail server gets an email, it checks the SPF record of the domain in the envelope sender (Return-Path) to verify the sending server is listed. SPF is a core email authentication standard that helps prevent email spoofing and improves deliverability.

RFC 7208 limits SPF evaluation to 10 DNS lookups. Each include:, a, mx, ptr, and exists: mechanism that requires a DNS query counts toward this limit. If evaluation requires more than 10 lookups, the result is PermError — which receivers treat as an authentication failure. As you add email services (each typically adding an include:), it is easy to exceed this limit. Use an SPF lookup counter to verify your record stays within 10 lookups.

The all mechanism at the end of an SPF record is the catch-all that determines what happens to senders not matched by earlier mechanisms. -all (fail) means unauthorised senders should be rejected — this is the recommended value for domains in production. ~all (softfail) means unauthorised senders should be treated with suspicion but not rejected — useful during testing. +all (pass) allows any server to send email and should never be used. ?all (neutral) has no policy implication.

Reduce lookups by: (1) removing include: mechanisms for services you no longer use; (2) replacing include: mechanisms with the actual IP addresses they contain (SPF flattening); (3) using ip4: and ip6: mechanisms directly instead of a: or mx: where possible. For services that change their IP ranges frequently, monitor and update your flattened record regularly. An SPF flattening tool can automate the conversion of includes to IP addresses.