SPF Record Builder

Build one SPF TXT record for approved mail senders.

Runs locally

DNS & EMAIL

SPF Record Builder

Which SPF policy should you choose?

-allFailUnauthorized senders fail SPF. Use after every legitimate sender has been added and tested.

~allSoftFailUnauthorized senders are suspicious but may still be accepted. Best while setting up and monitoring.

?allNeutralNo positive or negative decision is made. This provides very little protection.

Recommended path: start with SoftFail, verify Microsoft 365, Google, Exchange, websites, CRM and third-party senders, then move to Fail.

SPF Record Builder

Generate a single SPF TXT record for approved senders.

How to use this builder

Add every system that is allowed to send email using your domain:

If you send through Microsoft 365, add spf.protection.outlook.com as an include domain.
If you send through Google Workspace, add _spf.google.com as an include domain.
If an on-premises Exchange server sends mail directly, add the public IPv4 address used for outbound email.
If a website, CRM, help desk, newsletter platform or other service sends mail for your domain, add the SPF include domain or sending IP provided by that service.

Only authorize services that actually send email for your domain. Check each provider's current SPF documentation before publishing.

ADD EXAMPLE:

INCLUDE DOMAINSUse a comma to separate multiple domains. 0 includesAPPROVED IPV4 ADDRESSESUse a comma to separate multiple public IPv4 addresses. 0 addressesDEFAULT POLICY

SPF TXT VALUEv=spf1 ~all

0/10 direct include lookups11/450 recommended characters

SPF Checker

Check whether a domain has SPF, then validate the published record.

Enter a domain to run a live TXT lookup. If SPF is found, its record is loaded below for local syntax checks.

DOMAIN NAME

SPF TXT VALUE (manual check)

DMARC Record Builder

Create an enforcement and reporting policy.

DOMAIN POLICYSUBDOMAIN POLICYREPORT EMAILAPPLY TO %

_dmarc TXT VALUEv=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100; sp=quarantine; adkim=s; aspf=s

Start with monitoring, verify legitimate senders, then move toward enforcement.

DNS TTL Calculator

Convert TTL seconds into a readable duration.

TTL IN SECONDS

PROPAGATION CACHE WINDOW1 hoursResolvers may cache the previous value for up to this duration.

SPF Record Builder

SPF Record Builder

SPF Record Builder

SPF Checker

DMARC Record Builder

DNS TTL Calculator

SPF Record Builder

When to use this tool

Use it in three steps

Related DNS & Email tools