SPF Record Builder

How this tool works

This builder assembles an SPF TXT record from your selected email providers, custom includes, and IP addresses. It tracks DNS lookup count in real time against the RFC 7208 limit of 10 and warns when you approach or exceed it. The generated record uses your chosen enforcement mechanism (-all or ~all).

Note: This tool generates the record — it does not publish it. You must replace your existing SPF TXT record at the domain apex in your DNS provider. Only one SPF record should exist per domain.

Understanding the 10-Lookup Limit

SPF allows a maximum of 10 DNS lookups. Each include:, a:, mx:, and redirect= counts as one lookup. ip4: and ip6: do not count.

Tips for Staying Under the Limit

• Use ip4: and ip6: instead of include: where possible
• Consolidate services that share infrastructure
• Consider SPF macro hosting for complex setups
• Remove includes for services you no longer use

Hard Fail vs Soft Fail

-all (hard fail) tells receivers to reject emails from unauthorized sources. ~all (soft fail) marks them as suspicious but still delivers. Use -all once you are confident all senders are authorized.