Build a valid SPF record,lookup-limit safe.
SPF is one line of DNS that tells the world which servers are allowed to send mail as you. Get it wrong and your campaigns land in spam or get forged. Toggle the tools you actually send from, add your own IPs, pick your policy, and copy a record that's valid and stays under the 10-lookup ceiling that silently breaks most setups.
Your sending sources
Email providers you send from
A domain may have only one SPF record. To add a sender later, edit this line, don't publish a second one.
Your SPF record
Valid SPF record
v=spf1 include:_spf.google.com -all
DNS lookups
1 / 10
Record check
Strict policy
Unlisted senders will be rejected.
Your move
A record that passes is the floor. Inboxing is the game.
Your record uses 1/10 DNS lookups with a -all policy.
SPF, DKIM, and DMARC get you authenticated, but landing in the inbox at scale takes warmup, list hygiene, and copy that doesn't trip filters. Send me your domain and your sending stack and I'll tell you, free, exactly what's keeping you out of the primary tab and what I'd fix first.
Plain English
One line of DNS decides who can send as you.
SPF (Sender Policy Framework) is a TXT record you publish in DNS that lists every server allowed to send email from your domain. When a receiving server gets a message claiming to be from you, it looks up your SPF record and checks whether the sending IP is on the approved list. If it isn't, your policy tells the receiver what to do about it. No SPF record means anyone can spoof your domain, and modern inboxes increasingly bin mail from domains that don't authenticate.
The single biggest way SPF breaks is the 10 DNS-lookup limit. Every `include:` mechanism (and a few others) costs one DNS lookup, and some of those includes nest and pull in more. Exceed ten and the whole record returns a `permerror`, which most receivers treat as a hard fail, the exact opposite of what you wanted. That's why stacking 'just one more' email tool is so dangerous: each provider you add eats into a hard budget. This generator counts your lookups as you build so you see the wall before you hit it.
Two more rules trip people up. First, the policy at the end: `-all` (hard fail) tells receivers to reject anything not on your list, while `~all` (soft fail) tells them to accept but flag it. Start on `~all` while you're sure you've listed every legitimate sender, then tighten to `-all` once you trust it. Second, a domain may only have ONE SPF record. If you publish two TXT records both starting `v=spf1`, SPF breaks entirely. Adding a new sender means editing the one record, not creating another.
The formula
v=spf1 + [includes & IPs, ≤10 DNS lookups] + (-all | ~all)
Google Workspace plus SendGrid, hard fail: `v=spf1 include:_spf.google.com include:sendgrid.net -all`. That's 2 of your 10 lookups used, every other server is told to reject mail claiming to be you.
Your SPF record isn't behaving. Here's why.
Record returns permerror.
You've blown the 10 DNS-lookup limit. Count your includes; consolidate providers, drop tools you no longer send from, or flatten high-lookup includes into raw IP ranges.
Legit mail still fails SPF.
A sending source isn't listed. Find every system that sends as you, transactional, marketing, helpdesk, CRM, and add its include or IP before you go to -all.
Two SPF records published.
A domain may only have one. Merge them into a single v=spf1 line; two TXT records both starting v=spf1 is an automatic fail.
Spoofed mail still gets through.
You're probably on ~all (soft fail) or have no SPF at all. Once you've confirmed every real sender is listed, switch to -all so unlisted servers get rejected.
How to keep SPF clean and passing
01Inventory every sender first
List each system that sends mail as you before you write the record: email host, ESP, transactional API, CRM, support desk. A missing one is a deliverability hole.
02Respect the 10-lookup budget
Every include costs a lookup, and some nest deeper. Treat ten as a hard ceiling and design your record to stay well under it.
03Drop tools you no longer use
Old includes for a trial you abandoned still burn lookups and widen your attack surface. Prune ruthlessly when you change providers.
04Start on ~all, finish on -all
Publish ~all (soft fail) while you confirm nothing legitimate is failing, then tighten to -all so spoofers get hard-rejected.
05Flatten when you're cornered
If you genuinely need more senders than ten lookups allow, replace high-lookup includes with their resolved ip4/ip6 ranges, but then you must maintain them as the provider changes IPs.
06Keep exactly one SPF record
Adding a sender means editing the single v=spf1 TXT record, never publishing a second one. Two SPF records breaks authentication outright.
07Use a subdomain for bulk sending
Send marketing from a subdomain (e.g. mail.yourdomain.com) with its own SPF. It isolates lookup budget and protects your root domain's reputation.
08Pair SPF with DKIM and DMARC
SPF alone isn't enough. DKIM signs the message and DMARC ties it together and tells you who's failing. The three together are what inboxes actually reward.
The vocabulary
- SPF
- Sender Policy Framework: a DNS TXT record listing the servers allowed to send mail for your domain.
- include
- A mechanism that pulls another domain's SPF record into yours (e.g. include:_spf.google.com). Each one costs a DNS lookup.
- DNS lookup limit
- SPF allows a maximum of 10 DNS-resolving mechanisms. Exceed it and the record returns permerror and fails.
- -all (hard fail)
- The strict policy: receivers should reject any mail from servers not listed. The recommended end state.
- ~all (soft fail)
- The lenient policy: accept but flag mail from unlisted servers. Useful while you verify your record.
- SPF flattening
- Replacing high-lookup includes with their resolved IP ranges to stay under the 10-lookup limit, at the cost of manual upkeep.
SPF questions, straight answers
An SPF record is a DNS TXT entry that lists which servers are allowed to send email as your domain. You need one: without it, anyone can spoof your address, and most inbox providers now penalize or reject mail from domains that don't authenticate. It's the cheapest deliverability win there is, one DNS record.
Keep going
A calculator tells you what. A call tells you what to do about it.
Send me the account behind these numbers. I'll tell you straight where the money's leaking and what I'd fix first — free, and you keep it whether you hire me or not.