SPF Record Builder

Builds the v=spf1 TXT record that tells receiving mail servers which hosts may send mail for your domain. Add your own sending addresses as ip4 or ip6, pull in third-party senders as include: mechanisms, and choose how the record ends. A running lookup counter sits beside the output, and warnings fire on the usual traps: a record past 255 bytes, a ?all that asserts nothing, and +all, which tells the world that anyone may send as you.

The lookup budget is the constraint that catches people. RFC 7208 allows at most ten DNS lookups per evaluation, and include, a, mx, ptr, exists and redirect each spend one — plus however many their own records spend, recursively. ip4 and ip6 cost nothing, which is why replacing a provider's include with its literal ranges is the standard way out of a record that has outgrown the limit. Go over ten and the result is not a soft failure: evaluation returns permerror, and a receiver treating that as a failure will reject mail that should have been delivered.

Two details decide whether the record does what you think. SPF authenticates the envelope sender — the MAIL FROM address, which appears as Return-Path in the received message — and not the From: header the recipient actually reads. A message can pass SPF cleanly while displaying any sender address at all, which is precisely the gap DMARC's alignment check exists to close. And SPF breaks on plain forwarding: a mailing list or a forwarded mailbox relays your message from its own servers, and unless it rewrites the envelope sender the check fails through no fault of yours. That is the argument for ending in ~all rather than -all while you are still finding out who sends on your behalf.

Publish exactly one v=spf1 record per domain — two of them is a permerror, not a merge — and keep ptr out of it, which the RFC itself says should not be used. TXT strings are capped at 255 bytes each; longer records are split into several strings that receivers concatenate, but a record needing that is usually a record that needs flattening instead.