Network Tools

Email authentication utility

SPF Record Generator & Validator

Build or safely revise one SPF TXT record, inspect every ordered term, and catch syntax, CIDR, policy, lookup-budget, and DNS-size risks before publication.

  • Guided and advanced editing
  • RFC 7208-aware diagnostics
  • Private, browser-only processing
  • Import, compare, and export

Configure the policy

Changes update the draft immediately. Nothing here publishes or queries DNS.

MAIL FROM domain where this TXT record belongs. Unicode names are converted to DNS A-labels.

Document the SMTP client identity separately; it may need its own SPF policy.

Import an existing value

Paste a TXT value, quoted character-strings, or a BIND-style line. A valid import replaces the current draft for editing.

Add authorized sending sources

Use one source per line or separate entries with commas. The selected qualifier applies only to items added in this batch.

Pass is the normal choice for sources you authorize.

Cross an administrative boundary and require the target SPF result to pass.

Dotted-quad address; prefix length must be 0–32.

Compressed IPv6 is accepted; prefix length must be 0–128.

Domain-backed sources

Ordering matters: evaluation stops on the first matching mechanism. Use the advanced editor to inspect or rearrange exact order.

Ordered mechanisms

Change a qualifier or move a term. The terminal all mechanism is managed separately and always remains after these sources.

Terminal policy and modifiers

The unsafe +all outcome is explained below but cannot be selected.

Use only for a shared full policy under the same administrative control.

exp= is fetched only after a Fail result; it does not authorize senders.

Draft TXT record

A local syntax review of the current draft.

Review
Terms1
Lookup lower bound0 / 10
Characters / bytes11 / 11
TXT strings1
Record valueNew local draft
v=spf1 ~all

Validation findings

    Raw token breakdown

    SPF evaluates mechanisms from left to right and stops on the first match. Modifiers do not match.

    #TokenKindResult if matchedDirect lookup cost
    Change summary

    No record has been imported; this is a new draft.

      Publication format

      Create or update one TXT record. Interface labels vary; verify against your provider’s documentation.

      TypeTXT
      Host / name@
      TTLProvider default

      Paste-ready provider value

      v=spf1 ~all
      TXT character-string chunks

      DNS TXT character-strings are limited to 255 octets. Multiple quoted strings in one TXT record are concatenated without adding spaces; do not publish them as separate SPF records.

        Qualifier outcomes

        • + Pass: the matching source is authorized. It is implicit when no qualifier is written. Never use +all; that authorizes every sender.
        • - Fail: the matching source is explicitly unauthorized. Use -all only after every legitimate sender is inventoried and tested.
        • ~ Softfail: probably unauthorized, but receivers should not reject solely on that SPF result. This is the safe rollout default.
        • ? Neutral: the policy makes no assertion; receivers must treat it like no SPF conclusion.

        Mechanism decisions

        • ip4 / ip6 Exact addresses or CIDRs; no evaluation-time DNS term cost and usually the most predictable.
        • include Tests whether another domain’s SPF policy returns Pass; its nested tree also consumes the shared lookup budget.
        • a / mx Authorizes resolved addresses for a domain or its MX hosts. Add only when those hosts really send outbound mail.
        • exists Performs a macro-expanded A lookup for specialized policy designs. Use only when you understand the DNS behavior.
        • redirect= Inherits another full policy after no mechanism matches. It is ignored if any all exists.
        • exp= Points to explanatory TXT text for Fail responses; it does not affect authorization.

        Load an editable example

        Examples use reserved documentation domains and addresses; replace every value before publishing.

        Deployment checklist

        1. Inventory every service and host that sends with this exact MAIL FROM domain, including applications, support tools, relays, and bounce domains.
        2. Find the current TXT records at the owner name. Merge any SPF policy into this one value—never add a second v=spf1 record.
        3. Publish as type TXT at the displayed host. Keep quoted chunks in one record and use a shorter TTL during a planned migration if your change process permits it.
        4. Keep ~all during discovery. Move to -all only after observed legitimate senders pass and responsible owners approve enforcement.

        Post-publish testing

        1. Query TXT from at least two independent recursive resolvers after the TTL and confirm exactly one returned value begins with v=spf1.
        2. Re-run a DNS-aware SPF checker to expand includes, count the complete lookup tree and void responses, and detect recursion this local estimate cannot see.
        3. Send controlled messages through every authorized path. Inspect Authentication-Results for SPF pass on the expected MAIL FROM or HELO identity.
        4. Monitor DMARC aggregate reports and delivery logs through a full business cycle before tightening policy; keep a tested rollback value.