Why is the 10-lookup limit a big deal?

RFC 7208 caps SPF evaluation at 10 DNS lookups per check (each include:, a, mx, ptr, exists costs one). If you exceed it the verifier returns permerror, which most strict DMARC policies treat as a fail.

Is `-all` or `~all` safer?

`-all` (hardfail) is the goal once you're sure every sender is listed — DMARC `p=reject` only kicks in for hard fails. `~all` (softfail) is the safer bootstrapping setting; mail still arrives but quarantined.

SPF Record Builder

Builds the `v=spf1` TXT record that tells receiving mail servers which hosts are allowed to send mail from your domain. Drop in your sending IPs, third-party providers (Google Workspace, Microsoft 365, Mailgun, etc.), and pick a closing all-qualifier. The tool keeps a running DNS-lookup count — SPF has a hard limit of 10 lookups per evaluation, and exceeding it produces a permerror that breaks delivery. Warnings light up for the common footguns: `+all`, `?all` neutral, records that overflow a 255-byte TXT chunk.

—

Presets

Built-in mechanismsmx (allow your MX hosts)a (allow your A/AAAA hosts)

ip4: hosts (comma or newline separated)ip6: hosts (comma or newline separated)include: (third-party SPF domains)All qualifier

TXT record

v=spf1 mx ~all

DNS lookups: 1 / 10 · 14 B

Warnings

`~all` softfail is the safe bootstrap value. Tighten to `-all` once DMARC reports look clean.

Publish as a TXT record on your apex domain. Only one SPF record per domain — multiples are a configuration error.

How to use

Start from the relaxed preset (`~all`) while you discover senders — soft-fail is forgiving for legitimate-but-unlisted mail.
Add every third-party provider via include: — never paste their IPs directly, they rotate.
Tighten to `-all` once your DMARC reports show no legitimate sources missing.

Frequently asked questions

Why is the 10-lookup limit a big deal?: RFC 7208 caps SPF evaluation at 10 DNS lookups per check (each include:, a, mx, ptr, exists costs one). If you exceed it the verifier returns permerror, which most strict DMARC policies treat as a fail.
Is `-all` or `~all` safer?: `-all` (hardfail) is the goal once you're sure every sender is listed — DMARC `p=reject` only kicks in for hard fails. `~all` (softfail) is the safer bootstrapping setting; mail still arrives but quarantined.

Related tools

DMARC Record Builder

Compose a `_dmarc` TXT record — policy, subdomain policy, percentage rollout, alignment, rua/ruf reporting — with safety warnings.

Network 0 0

Email Header Analyzer

Paste a raw email header to walk the Received hops in order, see the per-hop delay, and read off the SPF/DKIM/DMARC verdicts.

Network 0 0

DKIM Record Builder & Parser

Build or parse a DKIM (DomainKeys Identified Mail) DNS TXT record — paste your public key, pick selector, key type (RSA/Ed25519), hash and flags, get the full record plus the selector._domainkey hostname and a DNS-chunked version for records over 255 chars.

Network 0 0

TXT Record Splitter (255-Byte Chunks)

Split a long SPF, DKIM or DMARC TXT record into the 255-byte chunks the DNS protocol requires — outputs BIND, generic zone file, Cloudflare or Route 53 syntax.

Network 0 0

Content-Security-Policy Builder

Build a CSP header from per-directive source lists, with three starter presets and live warnings for the dangerous wildcards.

Network 0 0

Permissions-Policy Header Builder

Build the `Permissions-Policy` response header — toggle camera, microphone, geolocation, payment, fullscreen and 20+ other browser features by origin allowlist.

Network 0 0