What this tool does
This SPF record generator assembles the single TXT record that lists which servers may send mail using your domain. Pick the providers you use, add your own IP ranges, choose how strict the ending should be, and it produces the exact string to paste into DNS — while counting the DNS lookups it will cost and the characters it occupies.
Composing the record happens entirely in this tab. Resolving it does not: a page in a browser has no way to query DNS, so nothing here is checked against your live zone, and nothing you type is sent anywhere to be checked.
Reading the record you end up with
A record is a version tag, a list of terms and a verdict for everything the terms did not match:
v=spf1 include:_spf.google.com ip4:198.51.100.7 -all
include: delegates a decision to another domain's record, which is how a provider can change its
sending infrastructure without asking every customer to edit DNS. ip4: and ip6: take a literal
address or CIDR range and are the cheapest terms available, because answering them costs no query
at all. Bare a and mx mean "the addresses this domain already publishes", which is convenient
and quietly expensive. Terms are evaluated left to right and the first match wins, so the final
all only applies to a sender nothing else claimed.
The ten-lookup budget is the thing that breaks
Most broken SPF records are not malformed. They are valid, readable, and over budget. Each
include: costs one query for itself and then every lookup inside the record it points at — a
figure the provider can change without telling you. That is why the counter on this page is honest
about measuring only what you wrote: a record showing six lookups here can be resolving to fourteen
in production.
Two habits keep you inside the cap. Prefer ip4: for servers whose addresses you control, since
literals are free. And delete providers you stopped using — a trial platform from two years ago
still costs a lookup and still authorises whoever now owns that infrastructure.
When you genuinely cannot fit, the answer is a flattening service or a subdomain strategy, not a
second record. Sending transactional mail from mail.example.com gives that subdomain its own
record and its own budget, and it separates the reputation of your receipts from your newsletter.
One name, one record, 255 characters per string
The record lives as a TXT record at the domain root, and there must be exactly one of them starting
v=spf1. A single character string inside a TXT record holds 255 bytes; longer records are
published as several quoted strings in the same record, which resolvers join back together. Most
DNS control panels handle the splitting for you, but a few make you do it by hand, and doing it by
inserting a second record is the failure mode to avoid.
What SPF does not do
SPF checks the envelope sender — the address used in the SMTP conversation — against your list. The From line the recipient reads is a different field entirely, and nothing in SPF constrains it. A forger can pass your SPF check by sending from their own authenticated domain while displaying your brand in the From header. Closing that gap needs DKIM, which signs the message itself, and DMARC, which requires one of the two to align with the visible domain and publishes what receivers should do otherwise. Publish all three; SPF is the first of them, not the whole job.
If you are configuring several files at a domain root in one sitting, the ads.txt generator covers the advertising allowlist and the robots.txt generator covers crawler access.