SPF record generator

What is the SPF 10 lookup limit?

It is the rule in RFC 7208 that evaluating one SPF record may take at most ten DNS lookups. It is the usual way a working record breaks: someone adds another email vendor, the count tips over, and SPF starts failing with a permanent error on every message, not just mail from the new vendor.

The counts are not obvious either, because an include costs one lookup plus every lookup inside the record it points to.include:mailgun.orgnests two more includes, and those nest further, so one line in your record can use several lookups. Providers also restructure their records over time, so the counts in the generator are estimates: check the live record after any change.

The cheapest fix is IP mechanisms. ip4: and ip6: are evaluated inline and cost nothing, so authorising your own mail server by IP is always free where an include is not.

Do I need DKIM and DMARC as well as SPF?

Yes. On its own SPF is weak: it validates the envelope sender rather than the From address a person actually sees, and it breaks whenever a message is forwarded. It only becomes meaningful alongside DKIM, which signs the message and survives forwarding, and DMARC, which ties either result to the visible From domain and says what to do on failure.

Publish SPF first, then DKIM through your provider, then a DMARC record at p=none while you read the reports. Check the result with the SPF checker or the full deliverability audit.

What SPF record do I need for Google Workspace or Microsoft 365?

If that is the only service sending as your domain, one include is enough. Google publishesv=spf1 include:_spf.google.com ~all(Google’s SPF setup) and Microsoft publishesv=spf1 include:spf.protection.outlook.com -all(Microsoft’s SPF setup). Add every other service, such as a newsletter tool or help desk, to the same record. Tick them above and the generator puts them in one line.

How do I create an SPF record?

1. 1Tick every service that sends email as your domain. Each one shows the DNS lookups it adds.
2. 2Add your own mail server's IP addresses, and tick mx or a only if your domain's own hosts send mail.
3. 3Choose how the record ends: ~all while you confirm the list is complete, -all once you are sure.
4. 4Copy the record and publish it as a single TXT record on the root of your domain, replacing any existing v=spf1 record rather than adding a second one. Once DNS has updated, look it up with the SPF checker.

Example

You enter

Two ticked senders, Google Workspace and SendGrid, ending with -all.

You get

The record v=spf1 include:_spf.google.com include:sendgrid.net -all, which uses 3 of the 10 DNS lookups SPF allows.

Limits

No limits; the record is built in your browser.

Should my SPF record end in -all or ~all?

The ending is the policy for every server you didn't list, as defined in RFC 7208:

Who uses this tool, and for what?

IT admins

Add a new service, such as a help desk or billing tool, to the company record without pushing it past ten lookups and breaking SPF for every message.

Cold emailers

Set up SPF on each new outreach domain: usually Google Workspace or Microsoft 365, plus nothing else. Then add DKIM and DMARC.

Agencies

Build a correct record for a client's domain from the tools they actually use, and hand over the exact value to paste into their DNS panel.

SaaS teams

Authorise the transactional provider that sends receipts and password resets, such as Amazon SES or Postmark, next to the company's own mailboxes.

What can’t this tool tell you?

• It builds a record from the services you tick. It cannot see what actually sends as your domain; DMARC aggregate reports show you that.
• Lookup counts are estimates of each provider's record. Providers restructure their records, so the live count can differ from the number shown here.
• It does not read or merge your existing record. If you already publish SPF, combine the mechanisms into one record by hand.
• Only common providers are listed. For any other service, take the include: value from that provider's own setup guide.

Sources

• RFC 7208: Sender Policy Framework (SPF)
• RFC 7208, section 4.6.4: the ten-lookup limit
• Google Workspace: set up SPF
• Microsoft 365: set up SPF

Common questions

What is the SPF record for Google Workspace?

v=spf1 include:_spf.google.com ~all, published as a TXT record on your root domain. If other services also send as your domain, add their include: values to that same record rather than creating a second one.

What is the SPF record for Office 365?

v=spf1 include:spf.protection.outlook.com -all, published as a TXT record on your root domain. Merge any other senders' mechanisms into that one record, and keep the total under ten DNS lookups.

How do I create an SPF record?

Select every service that sends email for your domain, add any of your own sending IPs, choose what should happen to unlisted servers, and publish the result as a single TXT record on your root domain. The generator above builds it and counts the DNS lookups as you go.

What should my SPF record end with?

Use -all once you are confident every legitimate sender is listed: it asks receivers to reject mail from anything else. Start with ~all if you are unsure, which accepts unlisted mail but marks it suspicious. Never use +all: it authorises the entire internet to send as your domain.

Why does SPF only allow ten DNS lookups?

The limit exists to stop a single message triggering an unbounded chain of DNS queries. Each include, a, mx, ptr and exists mechanism costs one lookup. The important part is the failure mode: exceeding ten makes the whole record fail with a permanent error rather than ignoring the extras, so a record that worked last month can break by adding one vendor.

How do I fix too many SPF lookups?

Three options. Replace an include with the provider's published IP ranges, since ip4 and ip6 mechanisms cost no lookup at all. Consolidate vendors so you are not authorising four services that do the same job. Or use an SPF flattening service, accepting that it needs to track the provider's IP changes for you.

Can I have two SPF records?

No. Two TXT records beginning v=spf1 is invalid and makes SPF evaluation fail completely, which is worse than one imperfect record. If you already have an SPF record, merge the new mechanisms into it rather than publishing a second.