SPF Record Builder
Builds an SPF record step by step (ip4, ip6, include, mx, a, ~all, -all) and counts the terms that consume a DNS lookup, so you can compare against the limit of 10.
—
Build SPF without blowing the ten lookups
You switched email providers, signed up for a sending platform or inherited a domain, and now you need to publish the SPF TXT record without a single typo, because a mistake there means invoices and receipts landing in your customer's spam folder. Tick mx and a if your own server sends mail, paste your static IPs, list the provider includes, pick the closing policy, and the page assembles the line ready to paste into your DNS panel, with a lookup count below it.
Watch that counter closely: it adds 1 for mx, 1 for a and 1 for each include you typed, which means it counts the terms you wrote, not the real cost. SPF also counts lookups performed inside the records you include. Google's include, for instance, currently points at a record holding three further includes, so it eats 4 of your budget of 10, not 1. Meanwhile ip4 and ip6 cost no lookups at all, which is exactly why SPF flattening exists as a practice.
Publish it as a TXT record on the root host and keep exactly one v=spf1 record: two records produce a permerror and the whole policy gets ignored, which is worse than having none. Start with ~all while you inventory who actually sends on your behalf, billing system and marketing platform included, then tighten to -all once the list is settled. The tool does not validate IP formatting and never queries your domain's DNS: it builds the text in your browser and stops there.
Frequently asked questions
Should the record end in ~all or -all?
Can a domain have two SPF records?
Is the lookup counter on this page reliable?
Related Tools
DMARC Record Builder
Create a DMARC record with policy (none/quarantine/reject), percentage, ruf/rua mailto and SPF/DKIM alignment.
Email Header Analyzer
Analyzes a raw email header: Received server chain, per-hop delays, SPF, DKIM, DMARC results and spoofing warning signs.
Clear-Site-Data Header Builder
Build a Clear-Site-Data header (cache, cookies, storage, executionContexts) — useful on logout to wipe origin data.
Trusted Types Policy Builder
Generate CSP require-trusted-types-for and trusted-types directives with policy names — a modern anti-XSS mitigation.
Content-Security-Policy Builder
Build a Content-Security-Policy header by adding directives (default-src, script-src, img-src, frame-ancestors) with predefined sources.
JWT Builder (HS256)
Build a JWT by filling in header, payload and secret. HS256 signature computed in the browser via SubtleCrypto.