← All tools

SPF Record Builder & Lookup Validator

Add each sender your domain uses, and this builds a valid SPF record for you, with a live lookup-count meter so you catch the RFC 7208 10-lookup limit before receivers start returning permerror.

📖 Guide: How SPF records work

Last updated: September 9, 2026

How to use this tool

1. Click + Add mechanism for every system that sends mail on your domain's behalf: your own mail server, Google Workspace, Microsoft 365, a marketing platform, and so on.
2. Watch the lookup meter as you go — it counts what you've typed, though an include: almost always adds more lookups behind the scenes.
3. Choose a catch-all: -all once you're confident the list is complete, ~all while you're still testing.
4. Click "Validate via live DNS" to follow every include and confirm the real total stays at or under 10.
5. Copy the record and publish it as a single TXT record at your domain's apex.

Sample record

A typical SPF record covering a self-hosted mail server plus Google Workspace looks like this:

It's needed to tell receiving mail servers exactly which systems are allowed to send mail as your domain — without it, anyone can forge the "From" address and pretend to be you.

Step 1: Check what's published now

Look up your domain's current SPF record first — you'll want to fold in every sender it already lists rather than starting from a blank record and losing one.

Step 2: Build your new record

Add every system above that's allowed to send mail as your domain (start from the current record if you found one), then use the validator below to confirm the total lookup count.

This counts only what you've typed here. An include: to a third party (e.g. your email provider) almost always adds more lookups of its own, so use "Validate via live DNS" below for the real total.