Build the SPF record of your domain from the services that actually send your mail. The generator counts the DNS lookups the way receivers do and warns you before you reach the limit of 10.
The record is built in your browser: nothing you type is sent to us.
Check the record once published CAA, MTA-STS and security.txt generators
Most broken SPF records come from a handful of mistakes. Each one below comes with the message it produces and how to avoid it.
Why. Adding a new provider by creating another v=spf1 record gives every receiver a permerror: multiple SPF records found.
Fix. Add the new include to the existing record. The generator always produces one record with everything in it.
Why. Invoices, website forms or a helpdesk that send with your address but are not listed get spf=softfail and land in spam once DMARC is enforced.
Fix. Tick every service that sends with your address. Your DMARC reports list every sender, including the ones nobody remembered.
Why. Past 10 DNS lookups, SPF returns permerror: too many DNS lookups for every message.
Fix. Remove old providers, use ip4 ranges where a provider documents fixed addresses, and move bulk mail to a subdomain with its own SPF record.
Why. +all lets any server on the internet send as your domain; ?all says nothing. Both remove the protection SPF exists for.
Fix. End with ~all with DMARC, or -all without it. Fix the missing senders instead.
Why. The a mechanism authorises the address of your website. On shared hosting, hundreds of other sites use that address, and all of them can then send as you.
Fix. Leave a unticked unless your website’s server is yours alone; list the mail service your site uses instead.
On the domain itself, as a TXT record. In most DNS panels the name is @ or left empty. Subdomains that send mail need their own record.
Yes: v=spf1 -all says that no server may send for the domain. Add a DMARC record at p=reject and a null MX (MX 0 .) to close the domain completely.
Yes, as several strings in one TXT record, which receivers join together. Most DNS panels split a long value for you; what must never happen is a value cut short.
The generator knows the documented include of the main mail, newsletter and transactional services. For any other, copy the include from the provider’s help and add it in Other includes.
No, in your browser. Nothing you type is sent to us.