Security & Crypto

SPF Record Generator & Lookup Counter

Generate and validate RFC 7208 SPF TXT records, check mechanism syntax, and count lookups to avoid exceeding the strict 10-DNS-lookup limit.

Domain & fallback policy

Domain name All qualifier (Policy fallback)

Authorized sending sources

IPv4 Addresses / Subnets (space or comma separated)

IPv6 Addresses / Subnets (space or comma separated)

Include domains (e.g. Google, Microsoft, Mailchimp, Zendesk)

Authorize MX servers (mx mechanism) Authorize domain A/AAAA record (a mechanism)

Generate your record

Results

What the result means

Configure your domain's authorized email sending services, IP subnets, and policy fallback qualifiers to create an RFC-compliant Sender Policy Framework record. The generator checks mechanism formatting and computes the precise number of DNS-querying mechanisms included in the string, such as include directives, mx pointers, a records, and exists mechanisms. Because RFC 7208 section 4.6.4 limits SPF evaluations to at most 10 DNS lookups, the interface displays an active meter alerting you if your configuration risks exceeding the threshold. This safeguard prevents downstream mailbox providers from returning fatal PermErrors before you publish changes to your authoritative zone.

Related tools

Guides

Questions

What is the 10-DNS-lookup limit in SPF?

RFC 7208 section 4.6.4 limits SPF evaluations to 10 total DNS lookups across include, a, mx, ptr, and exists mechanisms. Exceeding 10 causes receivers to return a PermError, failing authentication.

Which qualifier should I use for ~all versus -all?

SoftFail (~all) is recommended while testing sending sources. HardFail (-all) instructs receivers to strictly reject unauthorized mail once you have inventoried all legitimate services.

Can I have two SPF TXT records on one domain?

No. Publishing multiple SPF TXT records causes receivers to fail SPF evaluation with a PermError. All mechanisms must be merged into one single v=spf1 record.