SPF Record Generator
Build an SPF record and count the lookups before it breaks.
What you provide
These cost no DNS lookups, so prefer them where you can.
How this calculation works
Mechanisms are assembled in the order evaluators process them, with direct IP ranges before includes because they cost no DNS lookups at all. The lookup count is the part that matters: every include, a, mx and ptr mechanism costs one, and each include drags in whatever that provider record includes recursively, which is why Google alone costs four. Exceed ten and the record evaluates to permerror, which most receivers treat as having no SPF at all.
What the results mean
- DNS lookups used
- Against the hard limit of ten. Above seven is worth acting on, because adding one more provider will break it.
- Direct IP mechanisms
- ip4 and ip6 cost nothing against the limit. Replacing an include with the ranges behind it is the reliable way to get back under.
- Policy
- What receivers should do with mail from anywhere else. Soft fail is the sensible starting point, and hard fail is where you want to end up.
Common problems and fixes
- Mail started failing SPF without any change
- A provider changed its own record. Because includes are evaluated recursively, a provider adding an include to its record adds lookups to yours, and you can cross the limit without touching anything. This is why the count is worth checking periodically rather than only when the record changes.
- Forwarded mail fails SPF
- Expected, and not something SPF can fix. Forwarding preserves the envelope sender while changing the sending server, so SPF fails at the forwarder by design. This is exactly why DMARC accepts either SPF or DKIM alignment: DKIM survives forwarding because the signature travels with the message.
Frequently asked questions
Can I have two SPF records?
No. A domain may publish only one, and publishing a second does not merge them, it invalidates both. Combine every mechanism into a single record instead, which is the most common SPF configuration error after exceeding the lookup limit.
Should I use -all or ~all?
Start with soft fail while you confirm nothing legitimate is being missed, then move to hard fail. A record ending in soft fail forever provides much weaker protection, since receivers are told the mail is suspicious rather than unauthorised. The move is the point of setting it up.
Is SPF enough on its own?
No. SPF authorises the envelope sender, which recipients never see, so it does nothing about a forged From address on its own. DKIM signs the message and DMARC ties both to the visible domain and tells receivers what to do. All three are needed, and DMARC is what makes the other two enforceable.
Put this on your own site
Free to embed, no attribution required beyond the source link the frame carries itself. It runs entirely in your visitor's browser, sets no cookies and loads no third-party script.
<iframe src="https://runthetests.com/embed/spf-generator/" width="100%" height="560" style="border:1px solid #e5e5e5;border-radius:8px" title="SPF Record Generator" loading="lazy"></iframe>
Preview it at https://runthetests.com/embed/spf-generator/. Embedded pages are marked noindex, so yours stays the canonical copy — not this one.