SPF Record Generator

An SPF record is one line of DNS that lists every server allowed to send email using your domain. It is simple to write and easy to break, and a broken one fails silently — nothing errors, your mail just performs worse. This generator assembles a valid record from the services you actually use and counts the lookups as you go.

The ten-lookup limit is the whole difficulty

Evaluating an SPF record may trigger at most ten DNS lookups. Every include, a, mx and redirect mechanism costs at least one, and provider includes nest inside each other, so a single large platform can consume several. Add a marketing tool, a CRM, a helpdesk and a transactional sender over a few years and you pass ten without noticing. Past the limit the record does not degrade — it fails, and every message you send is treated as unauthenticated. The counter here exists because this is the failure that catches experienced teams.

Choosing the terminator

The last mechanism decides what a receiving server should do with mail from a server not on your list. A soft fail marks it as suspicious but generally accepts it, which is the right setting while you are still discovering who sends on your behalf. A hard fail instructs the server to reject it, which is where you want to end up once your inventory is complete and DMARC reports are quiet. A neutral terminator states no opinion and is worth almost nothing. Start soft, finish hard, and let reports rather than confidence decide when to move.

One record, not several

A domain must have exactly one TXT record beginning v=spf1. Two is a configuration error, and receiving servers may ignore both, which turns a well-intentioned addition into a total failure. When you add a service, merge its include into the existing record rather than publishing a second one.

What SPF does not cover

SPF authorises servers, not messages. It does not survive forwarding, because the forwarding server is not on your list, and it says nothing about whether the visible From address matches the authenticated domain. That gap is what DKIM and DMARC close, which is why SPF should be treated as the first of three steps rather than the whole job.