Next step
DMARC Record Generator — tell mailbox providers what to do with failures
SPF alone has no enforcement. DMARC ties SPF and DKIM together and tells Gmail/Outlook exactly what to do when a message fails both.
Open the toolFree tool · No account
SPF Record Generator — build it right the first time.
Pick every service that sends mail for your domain and get a valid SPF record instantly — with a live count against the RFC 7208 10-lookup limit that silently breaks most hand-written records.
- No account needed
- 10-lookup limit checked live
- Compares against your live DNS
1. Who sends mail for your domain?
Select every service that sends mail using your domain — missing one means that provider's mail can fail SPF.
Custom includes
Raw IP addresses (self-hosted servers)
2. What happens to mail that fails this check?
Your SPF record
0 / 10 DNS lookups used
v=spf1 -all ⚠ No senders selected yet — this record would authorize nothing, which blocks all legitimate mail.
How to publish this
- Go to your DNS provider (Cloudflare, GoDaddy, Route 53, etc.)
- Add a TXT record at the root of your domain (host:
@) - Paste the record above as the value
- Wait for DNS propagation (usually minutes, sometimes up to 48h), then verify below or with the DNS Checker
If a record already exists, replace it — a domain can only have one SPF record. Two records is treated as invalid by every major mailbox provider.
Compare against your live record
How this works
SPF, in plain English.
What is an SPF record?
SPF (Sender Policy Framework) is a DNS TXT record that lists every server allowed to send mail as your domain. When a mailbox provider receives a message, it checks the sending server against your SPF record — if the server isn't listed, the message can fail authentication and land in spam or get rejected.
Why does the 10-lookup limit matter?
RFC 7208 caps SPF at 10 DNS lookups (each include, a, mx, exists, or redirect mechanism costs one). Go over it and receivers are required to treat your entire record as a PermError — meaning SPF stops protecting you at all, often silently, with no warning in your DNS provider's dashboard.
Can I have more than one SPF record?
No. A domain can only have one SPF TXT record. If you already have one and need to add a provider, merge the new include into the existing record rather than publishing a second one — two records make SPF invalid everywhere.
What if I go over the limit?
Flatten a low-risk include into its raw IP ranges (ip4:/ip6: mechanisms don't count against the limit), or remove a provider you're no longer using. Some ESPs publish their own "flattened" SPF include specifically to help with this — check their docs.
SPF is one of three
DKIM and DMARC still need setting up.
A correct SPF record stops spoofers using your domain outright — but Gmail, Outlook and Yahoo all also expect DKIM and DMARC. Brain checks all three continuously and tells you the moment one breaks.