Write an SPF record for your mail providers and see how many lookups it uses
Runs in your browser. Only the lookup you start is sent to cloudflare-dns.com or dns.google; nothing else leaves your device. Updated on 25 Oct 2026.An SPF record is one line of text, but a wrong character in it makes receivers ignore it completely. Tick the mail services that send for your domain, add any server addresses, choose how strict the ending should be, and the record is written for you with its lookup count.
Tick each service under Sends through, such as Google Workspace or Microsoft 365.
Add Other includes from your email service setup page, and any IPv4 or IPv6 addresses or ranges.
Choose an ending under Mail from anyone else: -all to fail, ~all to mark as suspicious, ?all for no opinion.
Press Copy under TXT record for the bare domain (host @) and publish it as a TXT record at @.
Replace any SPF record you already have rather than adding a second one.
Publish the SPF record as a TXT record on the bare domain, then check it on the other tab once DNS has updated. Nothing is sent anywhere while you build it.
Type a domain and the page asks a public DNS-over-HTTPS resolver (Cloudflare or Google, your choice) for its TXT records, picks out the one that starts v=spf1, and reads it term by term. Every include: and redirect= is followed, and the records they point at are read the same way, so the whole tree of allowed networks is laid out on one screen.
The count that matters is the number of DNS lookups. RFC 7208 section 4.6.4 limits a check to 10 terms that need DNS: include, a, mx, ptr, exists and redirect each count one, wherever they appear in the tree, while ip4, ip6 and all count nothing. Each counted term is numbered in the tree, so when a record goes over you can see which include pushed it there. Lookups that find nothing, called void lookups, are limited to 2, and a name that no longer exists is shown as void.
The generator tab writes a record from choices, with the Google Workspace and Microsoft 365 includes those providers document, and shows how many lookups it uses before the providers' own.
The rest of the article, and all 6 questions about SPF Checker, are on the SPF Checker page.
RFC 7208 lets a receiver make at most 10 DNS lookups while checking one SPF record, counting every include, a, mx, ptr, exists and redirect in the whole tree. Over 10, the result is a permanent error and SPF fails for every message, even from servers the record lists.
Both are valid. A record ending -all asks receivers to fail mail from servers not listed; ~all asks them to accept it but mark it as suspicious. Many domains start with ~all while they find every sender, then move to -all. Ending with +all or no all at all gives no protection.
No. RFC 7208 says a domain must publish exactly one TXT record starting v=spf1. With two, receivers cannot choose and return a permanent error, so SPF fails for all mail. Merge them into one record, keeping every include and address from both.
A void lookup is a DNS query that finds nothing: the name does not exist, or it exists with no record of the type asked for. RFC 7208 asks receivers to allow no more than 2, because a record full of dead names is a common attack on receivers. Remove names that no longer exist.
Still stuck? Ask about SPF Checker and anybody who knows can answer. No account needed.
Same job, other tools: DMARC Record Generator – Build a DMARC record step by step, from p=none reporting to p=reject.
On the related tools: Find the Sender IP of an Email – Paste the headers of an email to find the IP address of the server that sent it.