Skip to content
tlspeek

SPF

SPF generator

Assemble a v=spf1 record from the senders you name. Copy it into DNS. Nothing in the form is sent to a server.

Separate domains with spaces or commas. Nothing is looked up.

Everyone else

TXT value

v=spf1 -all

Direct DNS mechanisms counted here: 0. Nested includes are not expanded.

The record lists no senders. It only says what to do with everyone.

An SPF record is a single TXT value that starts with v=spf1. It lists the servers allowed to send mail for a domain, then ends with a decision for everyone else. include: names another domain whose own SPF policy is also trusted. ip4: and ip6: name an address or range directly and do not cause a DNS lookup. a and mx authorize whatever the domain's own address or mail-server records currently point at. The last term is usually -all, which means everyone else fails, or ~all, which is a softer failure many inboxes still accept.

This form builds that text in the browser. The includes, addresses, and checkboxes are not sent to tlspeek and are not looked up. Nested includes are not counted beyond the include: term you typed, so a record that looks under the limit of 10 can still go over once a receiver walks the included domains. After you publish the TXT record, use the SPF checker to read it back and count the real tree.

How to choose the pieces

Add one include for each company that sends mail as you: the mailbox host, the support desk, the newsletter tool. Copy the domain they tell you to include, not the whole record they publish. Add an ip4 or ip6 line only for a server you operate yourself. Check a if the web server's own address also sends mail. Check mx if every host in the MX set is allowed to send, and remember that each of those hosts adds another lookup when a receiver evaluates the record.

End with -all when you are sure the list is complete. Use ~all while you are still finding senders, and read DMARC reports before you tighten it. ?all does not ask receivers to treat other mail as a failure. +all authorizes the entire internet and should not be published. A record with no includes and no addresses, only an all term, says nothing about who may send.

Common mistakes

  • Publishing two TXT records that both start with v=spf1. Merge them into the one string this form builds.
  • Leaving an old vendor's include in place. Each include costs a lookup, and unused ones are how a record crosses 10.
  • Pasting a URL or an email address into the include box. The value is a domain name.
  • Putting the SPF text on _spf or on a subdomain when you meant the domain people see in the From address.

Publish the finished line as one TXT record on the domain. DNS hosts sometimes split a long value into quoted chunks. That is normal. The chunks are one record. The checker joins them before it counts.

FAQ

Does this form look up the includes?

No. It only checks that each include looks like a public domain name and that each address looks like an IP. The SPF checker is the lookup.

Why does the lookup count ignore nested includes?

The form cannot see inside another domain's SPF record without asking DNS. It counts the mechanisms you typed. The checker follows them.

Should I use -all or ~all?

Use ~all while you are collecting senders. Use -all when DMARC reports show that every legitimate sender is already listed.

Can I add more than one ip4 range?

Yes. Separate them with spaces or commas. Addresses do not count toward the 10-lookup limit.

Where does the record go?

On the domain itself, as a TXT record. It does not go on _dmarc or on a DKIM selector.