Truvo Free Tools

SPF record generator

An SPF record is a TXT record that lists which hosts may send mail for your domain. RFC 7208 caps the number of DNS lookups a receiver will perform while evaluating it at 10, and a record that goes over the cap returns permerror. This generator builds the record from the mechanisms you add and counts the lookups as you go.

SOC 2 CC6.1SOC 2 CC6.7SOC 2 CC7.2ISO 27001 A.5.14ISO 27001 A.8.20
Ali Aleali

Ali Aleali, CISSP, CCSP

Co-Founder & Principal Consultant

Former security architect for Bank of Canada and Payments Canada. 20+ years building compliance programs for critical infrastructure. These tools come out of that work.

Connect on LinkedIn

How the SPF record generator works

The record is assembled in your browser from the mechanisms you add, and the lookup counter updates with each one. Nothing is published for you: you copy the finished record into your DNS.

01

Add your senders

Add a mechanism for each system that sends mail as your domain: ip4 and ip6 for addresses you control, a and mx for your own hosts, and include for a provider that publishes its own record, such as a marketing platform or a helpdesk.

02

Watch the lookup counter

RFC 7208 counts include, a, mx, ptr and exists, plus the redirect modifier, against a limit of 10 DNS lookups, and an include chain counts every lookup it triggers downstream. Past 10, a receiver stops evaluating and returns permerror, which means the record no longer authorizes anyone. The counter shows where you stand before you publish.

03

Choose the all mechanism and publish

~all asks receivers to accept unlisted senders and mark them as a soft fail, which suits a rollout. -all asks them to treat unlisted senders as a hard fail. Publish the finished record as a TXT record on the domain itself, then confirm it with the SPF record checker.

SPF record over the limit? We fix it for you.

Truvo's security engineers set the policy, fix the senders that break when it tightens, and hand you the evidence an auditor asks for. Tell us the domain and we will scope the work.

Contact us

  • SPF under 10 lookups

  • Sender inventory

  • DKIM signing

  • DMARC to reject

  • Audit evidence

  • Fixed-price scope

SPF record generator: frequently asked questions

A single TXT record string, starting with v=spf1, that you publish on your domain. It lists the mechanisms you added, in the order you added them, and ends with an all mechanism that decides how receivers treat any sender not listed.

RFC 7208 limits a receiver to 10 DNS lookups while evaluating one SPF record. The include, a, mx, ptr and exists mechanisms and the redirect modifier each consume lookups, and an include pulls in whatever lookups the included record performs. When evaluation exceeds the limit, the receiver returns permerror rather than a pass, so the record stops doing its job.

Remove senders that no longer send, replace an include with the specific ip4 or ip6 ranges the provider publishes when that list is stable, and drop ptr, which RFC 7208 advises against using. The counter in the generator updates as you edit, so you can see the effect of each change before publishing.

~all is a soft fail: receivers usually accept the message and record the failure, which is useful while you are still finding senders. -all is a hard fail and asks receivers to reject. Move to -all once your DMARC reports show every legitimate sender passing, so a strict record does not stop your own mail.

No. RFC 7208 treats a domain with two or more v=spf1 records as an error, and receivers return permerror. When a new provider gives you an include, add it to the record you already publish rather than creating a second one.