Skip to content
newsletter-marketing24.deLaw · Deliverability · Metrics

Last reviewed:

Translated from German; if the versions differ, the German version applies.

SPF builder

The SPF builder puts together an SPF record under RFC 7208 from your details, counts the DNS lookups that the record itself triggers and explains every building block. It helps anyone who wants to specify which servers may send email for their sender domain – for example when a newsletter platform is added.

How an SPF record is structured

SPF (Sender Policy Framework) is a TXT record in the DNS of the sender domain with which the domain owner specifies which servers may send email for the domain. The record starts with v=spf1. Building blocks for permitted senders follow: a and mx for the servers of your own domain, ip4 and ip6 for addresses or networks, include for the permitted servers of another domain. At the end there is a rule for all other servers: -all (not authorised, result “fail”) or ~all (probably not authorised, “softfail”).

The builder checks two rules from RFC 7208 as well: more than ten DNS lookups turn the record into the error “permerror” (Section 4.6.4), and each domain may have only one SPF record (Section 4.5).

How to use it

  1. Enter your sender domain.
  2. Tick whether the web server (a) or the mail server (mx) of your domain may send, and enter your own addresses or networks.
  3. Under include, enter the domain that your sending platform names in its instructions.
  4. Choose the ending, copy the record and use it to extend your existing SPF record – or create it as a new record if there is none yet.

The builder

Permitted senders

Servers of your own domain
All other servers

TXT record for your-domain.de

v=spf1 -all

    According to RFC 7208. The tool does not query the DNS: it cannot see how many lookups included records bring with them. The DMARC reports show whether the record works.

    What the builder does not check

    • What included records bring with them. Each include counts as one lookup, plus all the lookups in the included record. The builder cannot see those, because it does not query the DNS; the actual number may therefore be higher than shown.
    • Further limits from Section 4.6.4. At most two lookups without a result (“void lookups”) and at most ten address lookups per mx can only be checked with DNS lookups.
    • Whether the servers are yours and whether the record is already in the DNS. This is shown by the DMARC reports or your DNS provider.
    • Rare building blocks. The builder does not offer ptr, exists and redirect; according to RFC 7208, ptr should no longer be published anyway (Section 5.5).
    • DMARC. SPF checks the sender in the envelope of the email, not the visible sender line. Whether the two match is checked by DMARC; for that there is the DMARC builder.

    Frequently asked questions

    How many DNS lookups may an SPF record trigger? At most ten. include, a, mx, ptr, exists and redirect trigger lookups; ip4, ip6 and all do not. With more than ten, recipients treat the record as an error (RFC 7208, Section 4.6.4).

    Does the record end with -all or with ~all? RFC 7208 says: anyone who wants recipients to be able to identify unauthorised senders unambiguously must end the record with -all (Section 2.1). ~all is a weaker statement. The builder is preset to -all.

    What if there already is an SPF record? Extend the existing record with the new building blocks. If a recipient finds more than one record with v=spf1, the result is an error (RFC 7208, Section 4.5).

    What happens with more than 255 characters? A text string in the DNS holds at most 255 characters. Longer records are split into several strings, which recipients join together without spaces (RFC 7208, Section 3.3); the builder points this out.

    Further reading