SITE UNDER CONSTRUCTION. Everything here is provided AS IS, WITHOUT WARRANTIES, to the extent the law allows. It is information, not professional advice. Use at your own risk. Terms and liability limits →

eThorns ES
Menu
Buy us a coffeeEspañoleThorns 2026 · Made in Colombia
← DNS, email & networkES

Tool 2.3

SPF record builder: create your v=spf1 TXT record

Build one SPF record for your domain from your mail services, servers and IP ranges. Counts its DNS lookups and splits it past 255 characters.

Runs on your deviceRuns entirely in your browser: nothing you type or upload leaves your device.

How to use it

  1. Tick the services that send email with your domain, and type the include domain of any other service, as its help page gives it.
  2. Add your own servers if they send mail: the domain's own address (`a`), its mail servers (`mx`), or IPv4 and IPv6 addresses and ranges.
  3. Choose what happens to mail from any other server (`~all`, `-all` or `?all`), then copy the record into a TXT record at the domain itself, host `@`.

What an SPF record does, and what this page builds

SPF (Sender Policy Framework, RFC 7208) is a TXT record in your domain's DNS that lists the servers allowed to send email with your domain in the hidden return address. Receiving servers check it, and DMARC uses the result. You write one when you start sending from a new service, when you change email provider, or when a checker says your SPF record is missing or broken.

This page builds the record on your device from what you tick and type. It offers Google Workspace (include:_spf.google.com), Microsoft 365 (include:spf.protection.outlook.com) and Zoho Mail (include:zoho.com), as each provider's setup page gives them. It writes IP ranges first, then a, mx and the includes, and ends with the all you chose. Every address and domain you type is checked, and one that isn't valid is shown as an error instead of going into a record that receivers would reject. The page doesn't look up your DNS: to see what your domain publishes now, use the Email security checker.

Example: a shop that sends from Google Workspace and an invoicing server

tienda-ejemplo.co uses Google Workspace, and its invoicing software sends from the server 203.0.113.10. Tick Google Workspace, type 203.0.113.10 under IPv4 and keep ~all. The result is v=spf1 ip4:203.0.113.10 include:_spf.google.com ~all. Publish it as a TXT record at the domain itself, which many DNS panels call @.

The tool counts 1 DNS lookup, the include; the ip4 entry costs none. If the domain already has a TXT record that starts with v=spf1, replace it with this one. With two SPF records, SPF fails for all your mail (RFC 7208, section 4.5).

The 10-lookup limit and records over 255 characters

While checking SPF, receivers stop after 10 DNS lookups and treat more as a permanent error (RFC 7208, section 4.6.4). include, a, mx, ptr, exists and redirect cost one each; ip4, ip6 and all cost nothing. The tool counts the lookups written in your record, but it can't see inside each include, and a provider's record often includes others that count too. After you publish, the Email security checker follows the whole chain.

One TXT string holds at most 255 characters. Past that, the tool also shows the record cut into quoted strings, which receivers join back without adding spaces (RFC 7208, section 3.3); some DNS panels do this for you. Over about 450 characters the DNS answer may not fit in 512 bytes and some receivers may ignore it (section 3.4). List fewer ranges, or send newsletters from a subdomain with its own record.

FAQ

Should I use ~all or -all?

`~all` asks receivers to treat mail from unlisted servers as suspicious; `-all` asks them to fail it. Once your DMARC policy is `quarantine` or `reject`, DMARC decides what happens to that mail either way. With `-all`, some receivers refuse a message during delivery, before they look at its DKIM signature, which can drop forwarded mail that DMARC would have accepted (RFC 9989, section 7.1). Google recommends `~all` and Microsoft recommends `-all`.

Can a domain have two SPF records?

No. If a receiver finds more than one TXT record that starts with `v=spf1` at the same name, SPF fails with a permanent error (RFC 7208, section 4.5). Put every service in one record.

Why can't I add ptr?

RFC 7208 says the `ptr` mechanism should not be published (section 5.5): it is slow, unreliable, and costs DNS lookups. Use the provider's include or its `ip4` and `ip6` ranges instead.

Do I need to add my newsletter service?

Only if it sends with your domain in the hidden return address. Many newsletter services use their own return address, and then your SPF record is never checked for their mail; they rely on DKIM for your domain instead. The service's help page says whether it needs an include.

Does a subdomain use the domain's SPF record?

No. SPF is looked up at the exact name in the return address, so a subdomain that sends mail, such as `boletines.tienda-ejemplo.co`, needs its own SPF record at that name. It also gets its own limit of 10 lookups.

  • 2.1What's my IP?See your public IP address, whether it's IPv4 or IPv6, your country, TLS and HTTP version, and what every website can learn from your connection.
  • 2.2Email securityCheck a domain's SPF, DKIM, DMARC, MTA-STS, BIMI and DNSSEC, and get copy-ready DNS records for what's missing or wrong.
  • 2.4DNS lookupLook up any domain's DNS records (A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, SRV) or the reverse DNS of an IP, with TTLs and DNSSEC validation.
  • 2.5Email header analyzerPaste an email's raw headers to see the servers it passed through, the SPF, DKIM and DMARC results your provider recorded, and signs of a forged sender.
  • 2.6DNS propagation checkerAsk 10 public resolvers (Google, Cloudflare, Quad9, OpenDNS…) for a name's A, AAAA, CNAME, MX, NS or TXT records and see if your DNS change reached them.
  • 2.7DMARC report readerOpen a DMARC aggregate report (.xml, .xml.gz or .zip) and see, for each sending IP, how many messages passed or failed SPF and DKIM.
  • 2.8Is it down?Check whether a website answers, with its HTTP status, response time, redirects and HTTPS, measured once from our server in Colombia.
  • 2.9DMARC record generatorBuild a DMARC TXT record: policy, test mode, report addresses and alignment.
  • 2.10Link preview checkerSee how your link will look when shared on WhatsApp, X, LinkedIn or Facebook: check the title, description, og:image and Twitter card tags, with fixes.
  • 2.11Subnet calculatorType an IP address with its prefix to get the network, mask, broadcast, usable host range and count, and split it into equal subnets.

╌╌ END ╌╌