Select the services that send mail for your domain. We build the correct SPF record with the right include order and warn if you exceed the 10-lookup limit.
SPF records list the IP addresses and hostnames authorized to send email on behalf of your domain. Building one by hand means knowing the exact include: directive for every ESP you use, ordering them correctly, and tracking the total DNS lookup count against the RFC 7208 limit of 10. This generator does all of that automatically - pick the senders that mail for you, get the correct record.
When a receiving mail server evaluates your SPF, it resolves every include:, a, mx, exists:, and redirect= mechanism via DNS. RFC 7208 caps total lookups at 10. Exceed it and receiving servers return PermError - your SPF effectively fails.
The trap: lookups compound recursively. include:_spf.google.com alone burns 3 lookups (one for the include + two more inside Google's resolved record). Add Microsoft 365 (2), SendGrid (2), Mailgun (2), and your own mx (1) and you're at 10. Add one more service and SPF breaks.
This generator counts lookups per ESP and warns you before publishing if you're over.
~all (soft fail) - mail from unauthorized IPs is accepted but marked suspicious. Safe starting point: even if you forget a sender, mail isn't blocked.-all (hard fail) - mail from unauthorized IPs is rejected outright. Use once you're confident every legitimate sender is in your record.?all (neutral) - no opinion. Functionally similar to no SPF. Discouraged.+all (pass everyone) - allows ANY IP on the internet to claim to be your domain. Don't use.Best practice: start with ~all, monitor your DMARC aggregate reports for 30 days, then upgrade to -all once you're sure no legitimate mail is being soft-failed.
SPF is one of three records you need (SPF + DKIM + DMARC). The full guide walks through the alignment rules that make all three actually work together.
Read the SPF/DKIM/DMARC guide