Why does SPF have a 10-lookup limit?

RFC 7208 caps the number of DNS lookups (a, mx, include, exists, redirect) at 10 to prevent denial of service. Exceeding it returns PermError, which most receivers treat as fail.

Should I end with -all or ~all?

-all (hard fail) is correct once you're confident every legitimate sender is listed. ~all (soft fail) is safer while you're rolling out and lets receivers spam-fold rather than reject.

Is my SPF record sent to a DNS server from here?

No. The TXT string is built locally; you publish it via your DNS provider yourself.

How long can the record be?

A single TXT string is capped at 255 characters, but a record can be split across multiple quoted strings inside one TXT entry. The builder formats this automatically for long records.

spf · txt · sender policy framework · email

Build an SPF TXT record

Compose ip4, ip6, include, a, mx mechanisms with qualifier prefixes. Tracks DNS lookups so you stay under the 10-lookup limit.

SPF Record Builder

Mechanisms

rules

DNS lookups

/ 10

Default

~all

fallback

Bytes

txt

input · mechanisms

Add as a TXT record at the apex of your domain (e.g. @). Max 10 DNS lookups across all include, a, mx mechanisms.

output · spf record

v=spf1 ip4:192.0.2.0/24 include:_spf.google.com mx ~all

Quick Start

How SPF works

SPF tells receiving mail servers which hosts are allowed to send for your domain. It lives as a single TXT record at the apex.

01
List authorized hosts
Add ip4/ip6 ranges, a, mx, or include statements that name your senders.
Lookups reference the IANA registries (MIME, HTTP status, TLDs) bundled at build time — no live network calls, no rate limits, no leaked queries.
mechanismsIANAregistryofflinelive
rules · queryhosts · IANA
```
ip4 · include · mx
```
loaded · IANA bundlespec · ready
02
Pick qualifiers
Use + (default, allow), ~ (softfail), - (hardfail), ? (neutral) per mechanism.
Builders emit canonical syntax per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs) so the output passes spec-compliant parsers.
qualifiersRFC 9110canonicalspec-compliantlive
q · options± ~ ? · live
```
~ -spammer.tld
```
options applied · livecanonical
03
Choose default 'all'
Most domains use ~all (softfail) while ramping up to -all (strict).
Validation flags common pitfalls — uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8 — before they bite production.
defaultvalidationlintpitfallslive
all · looked up~all · ready
```
~all
```
result · livevalidated
04
Publish TXT record
Add the value to a TXT record at @ for your domain.
Copy writes the snippet directly into your clipboard; downloads emit the right extension and MIME so curl/httpie pick them up correctly.
dnsclipboardMIME-correctblobcurl-ready
ok · copiedready · done
```
@ TXT "v=spf1 ..."
```
shipped · ready to shipsuccess

Pro tips

Web-spec details that bite later

Idempotency saves retries

POST/PUT/DELETE should be safely retried. Use idempotency keys and return the same response on duplicate requests.

Match RFC 9110 status codes

Don’t invent codes. 422 for validation errors, 409 for conflicts, 429 for rate limits. Standard codes work with off-the-shelf clients.

Set <code>Cache-Control</code> deliberately

Default browser caching is conservative. Use max-age + stale-while-revalidate for hot endpoints.

Validate Open Graph in dev

OG tags break silently. Use a previewer like OG Generator + Facebook’s debugger before launch.

CORS is a server concern

The browser sends the preflight; the server decides. Wildcard origins disable credentials — be explicit.

MIME drives behaviour

Servers must send the right Content-Type. Browsers sniff but the spec says they shouldn’t — be explicit to avoid surprises.

Use Cases

When to set SPF

Email deliverability, anti-spoofing, vendor authorization.

Stop spoofing

Prevent attackers from forging your domain in From addresses. Bundled from IANA registries at build time — no live network call, no rate limit, no leaked queries. The MIME, TLD, and status-code tables are baked in so the tool works offline once loaded.

spec-compliant

Improve deliverability

Inbox providers rank SPF-passing mail higher. Output is canonical per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs), so spec-compliant parsers accept it as-is. Cross-browser and cross-library behaviour stays consistent.

offline

Authorize vendors

Add include: lines for Mailgun, SendGrid, Google Workspace. Pairs with the curl-to-fetch converter for end-to-end test stubs — copy the curl from DevTools, paste, get an idiomatic fetch() body. Drop into Playwright/Vitest fixtures without manual translation.

IANA-backed

Transactional senders

Cover ip4 of your own SMTP relays. Catches common pitfalls (uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8) before they bite production. Validation flags rather than auto-corrects so you stay in control.

RFC-aligned

Marketing platforms

Authorize newsletter ESPs without giving up DKIM. Validation runs as you type — copy only when the output is shaped correctly. The output drops directly into nginx, Apache, or CDN configs without re-formatting or re-quoting.

production-grade

Subdomain delegation

Use redirect= or include= to chain SPF policies. Same input plus same options always produces identical canonical output, so the tool is safe to embed in CI scripts that diff against expected configs.

curl-ready

FAQ

Frequently asked questions

Why a 10-lookup limit?

RFC 7208 caps DNS lookups to prevent recursive lookup loops. Mail servers may treat over-limit records as permerror.

Should I pick ~all or -all?

Start with ~all to avoid breaking legitimate mail while you gather DMARC reports. Move to -all once confident.

Can I have multiple SPF records?

No. One TXT record per domain — combine all mechanisms into a single string.

What about subdomains?

Each subdomain needs its own SPF record or it inherits no policy. Inherit explicitly with include: parent.

Does it run locally?

Yes. Construction is entirely client-side.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!