DNS SPF Record Generator
Create standard Sender Policy Framework (SPF) DNS TXT records. Combine MX, A records, Google Workspace, Microsoft 365, SendGrid, and monitor the 10-lookup limit.
Email Senders & Policy Rules
Select authorized email providers and configure SPF enforcement.
Protecting Email Deliverability and Domain Reputation with SPF
Sender Policy Framework (SPF, RFC 7208) is an email authentication protocol that allows domain owners to publish a list of IP addresses or subnets authorized to send emails on behalf of their domain. Properly configured SPF records prevent spoofing, boost inbox deliverability rates, and ensure compliance with Google and Yahoo's mandatory bulk sender email policies.
Key Technical Features
10-DNS Lookup Limit Counter
Tracks and warns when your SPF record approaches or exceeds the hard 10-lookup limit that causes SPF PermError failures.
One-Click ESP Integration
Toggle popular email service providers including Google Workspace (_spf.google.com), Microsoft 365, SendGrid, Mailgun, Postmark, and AWS SES.
IPv4 & IPv6 Subnet Parsing
Cleanly add dedicated mail server IP addresses and CIDR notation subnets.
Configurable Enforcement Policy
Choose between Soft Fail (~all) for testing or Hard Fail (-all) for strict DMARC enforcement.
DNS Provider Setup Guides
Ready-to-copy instructions for Cloudflare, AWS Route 53, GoDaddy, and Namecheap DNS dashboards.
Instant TXT Record Syntax Checker
Validates RFC 7208 compliance in real-time as you toggle providers.
Engineering & DevOps Scenarios
- ✓System Administrators & IT Managers
Set up email authentication records for newly acquired corporate domains.
- ✓Email Marketing Specialists
Ensure high deliverability and avoid spam folders when onboarding transactional ESPs like SendGrid or Postmark.
- ✓Google Workspace & M365 Administrators
Safely merge cloud email suites with existing website notification servers.
- ✓Cybersecurity Analysts
Audit corporate DNS zones to prevent phishing spoofing and domain impersonation.
Frequently Asked Questions
What is the 10-lookup limit in SPF?
RFC 7208 specifies that an SPF check must not cause more than 10 DNS queries (from mechanisms like 'include', 'a', 'mx', 'ptr', and 'exists'). If resolving an SPF record requires more than 10 DNS lookups, the receiving mail server throws an 'SPF PermError', causing the email to fail authentication or go to spam.
What is the difference between '-all' and '~all'?
'-all' is a Hard Fail, instructing receiving mail servers to reject or bounce messages sent from unlisted IPs. '~all' is a Soft Fail, indicating that unlisted IPs should be accepted but flagged as suspicious or marked for DMARC quarantine. Soft Fail is recommended during initial setup, transitioning to Hard Fail once verified.
Can I have multiple SPF records on one domain?
No! Having more than one SPF TXT record on a single domain causes an immediate SPF PermError and invalidates authentication entirely. All authorized senders must be combined into a single record starting with 'v=spf1'.
Does SPF alone stop email spoofing?
No. SPF only validates the 'Return-Path' (envelope) sender address, not the 'From' header displayed to users in email clients. To fully protect your domain against spoofing, you must configure SPF together with DKIM (DomainKeys Identified Mail) and DMARC.
Related Developer Tools
Need a Brain Break? ☕
Done working on your task? Take a quick 60-second break, test your reflexes, and flap through infinite pixel obstacles in Sky Flap!