1001Ferramentas
📧 Security

SPF Record Builder

Builds an SPF record step by step (ip4, ip6, include, mx, a, ~all, -all) and counts the terms that consume a DNS lookup, so you can compare against the limit of 10.

Build SPF without blowing the ten lookups

You switched email providers, signed up for a sending platform or inherited a domain, and now you need to publish the SPF TXT record without a single typo, because a mistake there means invoices and receipts landing in your customer's spam folder. Tick mx and a if your own server sends mail, paste your static IPs, list the provider includes, pick the closing policy, and the page assembles the line ready to paste into your DNS panel, with a lookup count below it.

Watch that counter closely: it adds 1 for mx, 1 for a and 1 for each include you typed, which means it counts the terms you wrote, not the real cost. SPF also counts lookups performed inside the records you include. Google's include, for instance, currently points at a record holding three further includes, so it eats 4 of your budget of 10, not 1. Meanwhile ip4 and ip6 cost no lookups at all, which is exactly why SPF flattening exists as a practice.

Publish it as a TXT record on the root host and keep exactly one v=spf1 record: two records produce a permerror and the whole policy gets ignored, which is worse than having none. Start with ~all while you inventory who actually sends on your behalf, billing system and marketing platform included, then tighten to -all once the list is settled. The tool does not validate IP formatting and never queries your domain's DNS: it builds the text in your browser and stops there.

Frequently asked questions

Should the record end in ~all or -all?
~all is a softfail that flags the message without discarding it. -all asks for outright rejection. Start with ~all while you inventory senders, then tighten to -all once the list is complete.
Can a domain have two SPF records?
No. More than one v=spf1 record causes a permerror and receivers ignore the policy entirely. Merge everything into a single record with multiple includes and IPs.
Is the lookup counter on this page reliable?
Treat it as a floor, not a verdict. It counts only the terms you typed and does not expand nested includes, which also count toward the limit of 10. Confirm with a validator that actually resolves DNS.

Related Tools