SPF record generator
Build your SPF record and watch the DNS lookup count as you go. Going over 10 lookups is the most common reason SPF quietly stops working, so this tool counts them for you. Everything runs in your browser.
A record that needs more than 10 lookups fails silently. Nothing bounces and no warning appears, which is why senders often cannot work out why authentication broke.
Each a, mx and include costs one lookup. IP addresses cost none. Every include can expand into further lookups inside the provider's own record.
Your SPF record
Enter a valid domain above and the record appears here.
What this covers in your audit
Authorising senders supports SOC 2 Trust Services Criteria CC6.6 and CC6.7, and ISO 27001:2022 Annex A 8.20 and A 5.14.
An SPF record is a written statement of which systems may transmit mail on the organisation's behalf. That is a useful artefact in an audit, because it shows the sending estate has been enumerated rather than left open.
It contributes evidence toward those controls rather than satisfying them. The record needs to be kept current as senders change, and SPF only becomes meaningful alongside DKIM and an enforcing DMARC policy.
What you need to know
The 10 lookup limit, and why records break silently
Evaluating an SPF record may trigger at most 10 DNS lookups. Each a, mx, include, ptr, exists and redirect counts as one, and every include can pull in more from the provider's own record. Go over the limit and the result is a permerror: most receivers then treat SPF as if it were not there at all. Nothing bounces, no warning appears, your mail simply loses its authentication. The counter above counts the mechanisms in this record; because an include can expand further, treat a total near 10 as already at risk. Fix it by replacing includes with the specific ip4 ranges your providers publish, or by retiring senders you no longer use.
~all versus -all
~all (softfail) tells receivers the message is probably not authorised but asks them not to reject it outright. -all (hard fail) asks them to reject it. Start with ~all while you confirm every legitimate sender is listed, then move to -all once your DMARC aggregate reports show no surprises. -all is the end state you want: softfail alone gives an attacker room.
Only one SPF record per domain
A domain may publish exactly one TXT record starting with v=spf1, at the root of the domain. If you already have one, merge the new entries into it rather than adding a second. Two SPF records is a permerror and invalidates both.
SPF alone does not stop spoofing
SPF checks the envelope sender, not the From address a recipient sees, and it breaks when mail is forwarded. It only becomes effective when paired with DKIM and a DMARC policy that is set to quarantine or reject.