SPF Record Generator

SPF record generator with a live DNS lookup counter

SPF records look trivial. One line of text, a few mechanisms, done. Then the record quietly grows past ten DNS lookups and every message starts failing with a permerror, and nothing in your DNS panel warns you. This builder writes the exact v=spf1 TXT value from the mechanisms you tick, sticks to RFC 7208 syntax with nothing invented, and counts your lookups as you type so you see the wall before you hit it. Everything runs in your browser. Once it's published, paste your domain into the SPF record checker to confirm DNS serves what you wrote, nested includes and all.

v=spf1 ~all

What an SPF record generator does

An SPF record generator writes the exact v=spf1 TXT value you publish in DNS, built from the servers you tell it send mail as your domain, so receivers can check that a message really came from a host you authorized. SPF answers one narrow question: is the server delivering this message allowed to send for the domain in the envelope sender, the return-path address bounces go to. The receiving server reads your TXT record, walks the mechanisms left to right, and stops at the first match. This builder turns that into a checklist, ip4 and ip6 fields, and provider presets, then prints the record and the host to publish it at.

The 10 lookup limit, the thing that breaks records nobody touched

RFC 7208 caps the mechanisms that trigger DNS lookups at ten per check. include, a, mx, ptr, exists and redirect cost one each, and go over and the result is permerror, which under a strict DMARC policy means your real mail starts bouncing. The nasty part is that nested includes count too. include:_spf.google.com is not one lookup, it is one plus whatever Google pulls in underneath, and that record is theirs, not yours. A domain can sit at a comfortable eight for a year, then break on a Tuesday because a marketing platform restructured its own SPF tree. The live counter is your early warning, so treat anything past seven as a budget problem.

Softfail vs hardfail, the honest version

The textbook says ~all marks failures as suspicious and -all rejects them, which is true but incomplete. In practice most large receivers feed the SPF result into DMARC and their own filtering rather than bouncing on SPF alone, so the day to day gap is smaller than the syntax suggests. Smaller, not zero. Run ~all while you are still discovering senders, because a forgotten invoicing tool under ~all lands in spam where someone notices, while under -all it just vanishes. Move to -all once the inventory is genuinely done, meaning a few weeks of clean DMARC reports. Skip ?all, and never publish +all, which declares the whole internet authorized to send as you.

Privacy and accuracy

The whole generator runs in your browser, so the domain and senders you type never leave your machine and the page works offline once it has loaded. It follows RFC 7208 syntax and invents nothing, validating ip4, ip6 and include hostnames as you go and flagging duplicates, the 255 character TXT string ceiling, and the dangerous qualifiers. One caveat: the counter only sees your top level. Every include pulls in its own record, and the lookups inside it count against the same limit of 10, so confirm the real total against live DNS with an SPF record checker after you publish.