SPF Record Builder and Checker
List the places your email is sent from to get the TXT record, or paste an existing record to check its syntax and count its look-ups.
Worked examples
Mail servers plus one service
Allow my mail servers, include _spf.mailprovider.example, everything else soft fail
v=spf1 mx include:_spf.mailprovider.example ~all, using 2 of 10 look-ups
Each include and mx costs one look-up.
About SPF Record Builder and Checker
SPF is a list, published in your DNS, of the servers that may send email for your domain. Receiving mail systems read it and treat mail from anywhere else with suspicion. A record that is wrong does harm in both directions: real mail lands in spam, or forged mail gets through. It is also surprisingly easy to get wrong, because the format is strict, only one record may exist, and there is a hard limit on how many look-ups the record may cause.
The builder puts your mail servers, the services that send for you and any fixed addresses into the right order and finishes with the rule you choose for everything else. The checker reads a record you paste and reports problems: a missing start, +all that lets anyone send as you, the slow and discouraged ptr, parts written after the all, invalid IP addresses, and records over 255 characters that must be split. It counts the look-ups and compares them with the limit of 10, after which receivers give up and report an error.
How to use SPF Record Builder and Checker
- Choose Build a record, then tick your own mail servers and add the services that send for you.
- Add any fixed IP addresses or ranges, and choose how to treat everything else.
- Check the notes and the look-up count, then copy the record.
- Add it as a TXT record at your domain, replacing any existing SPF record.
Common uses
- Setting up SPF for a new domain
- Adding a new email service without breaking the record
- Finding out why a record is over the look-up limit
- Auditing a record you inherited
Frequently asked questions
What is the 10 look-up limit?
Mechanisms such as include, a, mx and exists each need a DNS look-up. A receiver will follow no more than 10 in total, including those inside included records. Above that the result is an error and your mail may fail. This tool counts the record you give it, so remember that every included service adds its own.
What is the difference between -all and ~all?
-all says mail from other servers must fail, and ~all says it is probably forged but not to be rejected for that reason alone. Many people start with ~all while they check that every legitimate sender is listed, and move to -all after.
Why must I have only one SPF record?
If a domain has two, receivers treat the result as an error and ignore both. Combine everything into one record instead.
Why is +all dangerous?
It allows every server in the world to send mail for your domain, which removes the point of SPF. The checker reports it as an error.
What if my record is longer than 255 characters?
A single text string in DNS holds 255 characters, so a longer record must be split into several quoted strings inside one record. Your DNS provider may do this for you. Keep records short where you can.