Build SPF DNS records with an interactive tool to authorize email senders and prevent spoofing.
This tool assembles an SPF TXT record from the pieces of your mail setup: your domain, the IPs of your own mail servers, and include: entries for third-party senders like Google Workspace or your marketing service. It orders the mechanisms, appends the required terminating 'all' mechanism, and returns a publish-ready DNS value. The thing users get wrong most often: SPF authenticates the envelope sender, not the address shown in the From line, so a correct record alone does not stop the spoofing users actually see.
A concrete input and expected output from the current implementation.
Input
domain: example.com, mail server IP: 203.0.113.10, provider: Google Workspace
Expected output
v=spf1 include:_spf.google.com ip4:203.0.113.10 -all
Each entered sender becomes a mechanism in the record: the Google Workspace include, the single documentation-range IP, and -all to reject everything not listed. The ip4 mechanism costs no DNS lookups; the include costs one of the ten-lookup budget.
An SPF record is a single TXT value that starts with v=spf1 and then lists mechanisms. Receivers walk them left to right and act on the first match. The generator renders your mail servers as ip4: or a: mechanisms, third-party services as include: entries, and appends one all mechanism with the disposition you choose, since without it, unmatched senders get a neutral result instead of a rejection.
Evaluation may perform at most 10 DNS lookups; each include, a, mx, and redirect counts as one, and included records can chain their own includes on top of that. Over the cap, the check returns permerror, which receivers treat as neutral. TXT strings are also capped at 255 octets, so long records get split into multiple character-strings - a split some DNS software mishandles.
No. SPF looks up the TXT record at the exact domain in the envelope sender address, and subdomains do not inherit their parent's record. If envelope mail is sent from mail.example.com, publish the record there as well, or configure sending with the bare domain so one record covers everything.
There is no fixed count, but evaluation may make at most 10 DNS lookups, counting each include, a, mx, and redirect as one query - and included records can chain further includes of their own. Going over the cap yields permerror, treated as neutral, so your record silently stops working. Consolidate providers or use redirect= to stay inside the budget.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.