Tools
SPF Record Generator: Build a TXT Record and Count Lookups
SPF (Sender Policy Framework) is the TXT record that lists which servers may send email for your domain. Receiving mail servers check it, and DMARC relies on it. Tick the services that send as you, add any of your own servers, and the generator writes a single v=spf1 record ready to paste into your DNS. The two mistakes that break SPF most often are publishing two SPF records on the same domain and going over the limit of 10 DNS lookups; both make the whole record fail, and the tool checks for the second as you build.
Build your SPF record
How the 10-lookup limit works
The SPF standard (RFC 7208) caps the number of DNS lookups a receiver will make while checking your record at 10. Every include, a, mx, ptr, exists and redirect costs one lookup, and the includes inside each provider's own record count too. Plain ip4 and ip6 entries cost nothing. Go over 10 and receivers return a permanent error (permerror). DMARC does not count that as an SPF pass, so your mail then depends on DKIM alone.
The counter above adds up the lookups in your top-level record. It cannot see inside each provider's record without a live DNS query, so treat the figure as a minimum. If you are at seven or more, run your published record through a lookup checker before relying on it, and look for senders you no longer use.
Where the record goes
Publish it as a TXT record on the domain itself: the host is usually shown as @ or left blank in your DNS panel. If an SPF record already exists, edit that one rather than adding a second. Two records starting v=spf1 on the same name is an error, and receivers treat the domain as having no valid SPF at all.
Soft fail or hard fail?
With DMARC in place, ~all is the usual choice. DMARC makes the final decision either way, and a soft fail gives forwarded mail a better chance of reaching the inbox while DKIM does its job. -all is reasonable for a domain that never sends email at all, where the whole record should simply be v=spf1 -all. Never publish +all: it authorises every server on the internet to send as you.
Once SPF is live, build the matching policy with our DMARC record generator. Insurers increasingly ask about SPF, DKIM and DMARC on cyber insurance proposal forms because spoofed invoice emails drive so many social engineering claims.
