RFC 7208 COMPLIANT • NO REGISTRATION NEEDED

Free SPF Record Generator & Syntax Checker

Construct valid Sender Policy Framework (SPF) DNS records to prevent email spoofing, protect domain reputation, and ensure 100% inbox delivery.

Interactive SPF TXT Generator

Instant RFC 7208 syntax builder with automated 10-lookup quota tracking.

RFC 7208 DNS Lookups:2 / 10 Max

Select Authorized Email Providers (1-Click Add):

Domain Name

Allow Domain MX (mx +1 lookup)Allow Domain A (a +1 lookup)

Include External Domains (comma-separated)Each external include triggers 1+ recursive DNS queries against the 10-lookup limit.

Authorized IPv4 Addresses or CIDRs (0 Lookups)Pro-Tip: IP mechanisms consume 0 DNS lookups and prevent PermErrors!

Authorized IPv6 Addresses (0 Lookups)

Enforcement Qualifier Policy

Generated SPF TXT Record

DNS Name / Host: @ (Apex domain: example.com)

TXT @ "v=spf1 mx a ~all"

TTL: Recommended 3600 seconds (1 hour).Record Type: TXT

How SPF Works & DNS Mechanics (RFC 7208 Breakdown)

Sender Policy Framework is a core email security standard published as a single DNS TXT record at the root of your domain. When an SMTP server receives an incoming message claiming to be from your domain, it executes a DNS lookup to fetch your SPF string and inspects the connecting MTA's IP address.

Mechanisms & Directives

v=spf1: Mandatory protocol version identifier (must start the record).
include:<domain>: Delegates authorization to a 3rd-party vendor's SPF record (e.g. Google, M365).
ip4:<ip-or-cidr>: Explicitly authorizes an IPv4 address or subnet (0 DNS lookups).
ip6:<ip-or-cidr>: Authorizes an IPv6 address or subnet (0 DNS lookups).
mx: Authorizes all IP addresses resolved by the domain's MX records (+1 lookup).
a: Authorizes the IP address returned by the domain's A record (+1 lookup).

Enforcement Qualifiers

+ (Pass): Matches and explicitly authorizes the sender (default if omitted).
~ (SoftFail): Sender not authorized; message accepted but flagged (recommended for DMARC).
- (Fail / HardFail): Sender not authorized; commands recipient to reject message immediately.
? (Neutral): No policy asserted regarding the sender (testing only).

Strict RFC 7208 10-Lookup Limitation

To protect DNS resolvers from denial-of-service amplification attacks, RFC 7208 strictly limits the total number of DNS-querying mechanisms (include, a, mx, ptr, exists, redirect) to 10 lookups maximum. If an SPF record exceeds 10 lookups across all nested dependencies, major providers abort evaluation with PermError and treat the email as unauthenticated.

Step-by-Step Guide: Publishing Your SPF Record to Any DNS Provider

Once you have generated your SPF record above, follow these exact steps to publish it in your domain's DNS management console:

Cloudflare

Log in to Cloudflare Dashboard → Select your domain → Navigate to DNS > Records → Click Add record → Select Type TXT → Set Name to @ → Paste your SPF string into Content → Set TTL to Auto → Click Save.

AWS Route 53

Open Route 53 Console → Click Hosted zones → Choose your domain → Click Create record → Leave Record name empty (apex) → Set Record type to TXT → In the Value box, wrap your record in double quotes (e.g. "v=spf1 include:_spf.google.com ~all") → Set TTL to 300 or 3600 → Click Create records.

GoDaddy & Namecheap

Go to Domain Settings → Manage DNS → Add new record → Type: TXT → Host: @ → TXT Value: Paste your generated SPF string → TTL: 1 Hour (or Automatic) → Save. Check that no legacy SPF record exists before saving.

Common SPF Errors & Troubleshooting Real-World Bounces

Email delivery failures caused by SPF configuration issues typically manifest in bounce-back DSN headers. Here is how to diagnose and resolve the three most common bounce errors:

1. PermError: Too Many DNS Lookups (>10 Lookups)

Cause: Adding multiple third-party marketing services (SendGrid, HubSpot, Zendesk, Google) causes nested DNS queries to exceed the 10-lookup ceiling.

Fix: Remove unnecessary includes, migrate dedicated sending servers to static ip4: ranges (which consume 0 lookups), or run our SPF Lookup Calculator & Flattener to resolve nested mechanisms into flattened IP subnets.

2. Duplicate SPF Records Found (Multiple TXT Records Starting with v=spf1)

Cause: Publishing a new TXT record for a new email service without deleting or consolidating the existing SPF TXT record.

Fix: Delete the redundant TXT record in your DNS console. Merge all include: and ip4: mechanisms into a single TXT entry ending in ~all.

3. 550 5.7.26 DMARC/SPF Authentication Check Failed

Cause: Enforced by Google and Yahoo since 2024 for all bulk senders. Occurs when the domain in the "From:" header does not align with the SPF Return-Path or DKIM signature.

Fix: Configure custom domain authentication inside your sending platform so the Return-Path uses your domain (e.g. bounces.client.com), and ensure DKIM keys are published and aligned.

Frequently Asked Questions About SPF Records

Expert answers to critical SPF syntax, deliverability, and compliance questions.

What is an SPF record and how does it prevent spoofing?+

An SPF (Sender Policy Framework, RFC 7208) record is a DNS TXT record published on your domain that lists the authorized IP addresses and mail relay providers allowed to send emails using your domain in the Return-Path (envelope sender). Receiving mail servers check SPF during SMTP transmission to reject or quarantine forged emails sent by bad actors.

What is the RFC 7208 10-lookup limit, and what happens if I exceed it?+

RFC 7208 section 4.6.4 limits SPF evaluations to a maximum of 10 DNS queries that require recursive lookups (including "include:", "a", "mx", "ptr", "exists", and "redirect"). Exceeding 10 lookups causes receiving mailboxes (like Gmail, Outlook, Yahoo) to return a "PermError: too many DNS lookups", failing authentication and sending emails straight to the spam folder.

Can I publish multiple SPF records on the same domain?+

No. RFC 7208 explicitly specifies that a domain must contain at most one SPF TXT record. If multiple TXT records starting with "v=spf1" exist on a single host, receiving mail servers will immediately return a PermError and fail all SPF checks. You must consolidate all services into a single TXT string.

What is the difference between ~all (SoftFail) and -all (HardFail)?+

~all (SoftFail) signals to receiving mail servers that unlisted servers are likely unauthorized but allows them to accept the message with a flag, which DMARC uses to determine final disposition. -all (HardFail) commands immediate rejection of unauthenticated mail. Major providers including Google and Microsoft recommend ~all when coupled with an enforced DMARC policy (p=quarantine or p=reject).

Does SPF alone protect my domain from display name spoofing?+

No. SPF only authenticates the hidden SMTP envelope address (Return-Path / RFC 5321.MailFrom), not the visual "From:" header (RFC 5322) seen by email recipients. To achieve full email authentication and inbox display security, SPF must be deployed alongside DKIM (DomainKeys Identified Mail) and aligned via DMARC.