01
List actual senders first
The initial list is empty and ~all is only a draft ending. Add only IP ranges or include domains supplied by your real mail providers.
- The example uses documentation addresses; replace them before publishing.
Email Dev Tools
SPF record generator
Add sending sources in order, then inspect the TXT value and warnings before changing DNS.
SPF record generator
No sending mechanisms yet. Add only known senders.
v=spf1 ~all
Visible direct DNS terms: 0 / 10
TXT bytes: 11
This is not the full recursive lookup count; include and redirect targets are not fetched.
Ordered terms
~all— all · Active
Processed in this browser; no DNS query or update is sent.
Ending and redirect
Redirect replaces all; the previous all choice is kept.
Result ready. Review warnings before publishing.
Review before publishing
- No sending source is listed; this draft is not ready to publish.
An SPF record generator helps when a new sending service needs authorization but the current TXT policy is hard to reason about. An include and an IP rule can look interchangeable until their order changes which sender matches first.
Use this SPF record builder to keep mechanisms in evaluation order, or switch to the SPF record checker and paste an existing SPF TXT record. It checks the text locally and describes the SPF lookup limit without claiming to resolve the include chain.
Why use this SPF record generator
Keep the policy order visible and the DNS uncertainty explicit.
Ordered rules stay ordered
Move an IP or include row and the generated TXT changes in the same order. The SPF record generator also marks rules after all as unreachable in a pasted record.
A count with a clear boundary
The displayed number covers lookup terms visible in this TXT value. An include may add unknown downstream terms, so the SPF record generator never calls the count a complete DNS evaluation.
Set a policy without hiding its consequences
02
Keep first-match order
Move rows up or down to match the intended SPF evaluation path. Redirect replaces the all ending; turning it off restores the earlier all choice.
- Changing an option makes the old result stale and disables export until it is rebuilt.
03
Review the scope of each warning
In Check mode, paste one TXT value and inspect token positions, unreachable terms and the visible direct count.
- The 10-term limit applies across evaluated include and redirect chains, which this local page cannot expand.
Build and inspect the actual TXT value
Ordered mechanism table
Add include, ip4, ip6, a and mx with a qualifier per row; the exported string follows the same order.
Existing-record inspection
The SPF record checker keeps pasted TXT unchanged while checking syntax, address prefixes and policy endings.
Visible-budget explanation
A direct-term count highlights a crowded top-level record without mistaking it for the full SPF lookup limit.
What the local check can and cannot establish
- No live DNS inspection
- This SPF record generator does not fetch published TXT values, detect a second SPF record or count void lookups. Check the live domain separately after publishing.
- A long TXT value may be split
- Over 255 bytes, one DNS TXT record can contain multiple quoted strings. Do not create multiple SPF records to split one policy.
- Syntax is not delivery
- A valid SPF TXT record does not prove that a particular MAIL FROM domain, sending IP, DMARC alignment or recipient policy will accept a message.
- Implicit endings are not syntax errors
- Without all or redirect, SPF falls back to neutral. The checker warns so an accidental open policy does not pass unnoticed.
SPF record generator questions
What is a good SPF record to start with?
Inventory every real sending source first. The default ~all is a draft policy, not a ready-to-publish recommendation for a domain with unlisted senders.
What do -all, ~all and ?all mean?
They produce fail, softfail and neutral respectively when an all mechanism matches. +all passes every sender and is flagged as risky.
What is the 10-lookup limit?
RFC 7208 limits DNS-triggering terms during one evaluation to ten across nested includes and redirects. This page reports only visible top-level terms, so an include can increase the real cost.
Where do I publish the SPF record?
Add the resulting value as one TXT record at the sending domain in your DNS provider. Keep any required strings inside that same record.
Can I have more than one SPF record?
A domain should have one SPF TXT policy. Multiple matching SPF records cause a permanent error; this offline tool cannot detect records already published.
Still have an SPF policy question?
Use the SPF record generator on your next policy
Return to the SPF record generator to adjust ordered sources or paste a current TXT value before publishing.