InboxEagle
Free Tool

SPF Record Builder

Klaviyo, SendGrid, Google Workspace, and two other ESPs? That's potentially 8 DNS lookups — 2 away from breaking your SPF. Select every service that sends email from your domain and get the exact TXT record to publish — with a lookup count warning before you hit the limit.

Select every service that sends email on behalf of your domain.

Add any additional include mechanism not listed above.

What to do with emails from senders not in your SPF record.

DNS Record Name

yourdomain.com
TXT

Record Value

0/10 DNS lookups
v=spf1 -all

How to publish this record

  1. Log in to your DNS provider
  2. Create a new TXT record
  3. Set the Name/Host to @ (your root domain)
  4. Paste the record value above into the Value/Content field
  5. Delete any existing SPF records — you can only have one SPF TXT record
  6. Save and wait up to 48 hours for propagation

Why SPF Records Break — and How to Build One That Doesn't

Too many DNS lookups (>10)

SPF is limited to 10 DNS lookups. Each include: counts as one. Exceeding this causes a PermError, which means the entire SPF record is invalid — worse than having no SPF at all.

Multiple SPF records

You can only have ONE SPF TXT record on your root domain. Multiple records cause a PermError. If you need to combine, merge them into a single record.

Using ~all instead of -all

~all (SoftFail) marks unauthorized emails but doesn't reject them. This is fine for testing but leaves the door open for spoofing. Move to -all once you've verified all legitimate senders.

Forgetting third-party senders

Every service that sends email on your behalf (CRM, helpdesk, marketing automation) needs to be included. Missing one means those emails may fail SPF checks.

Related Free Tools

DMARC Generator → Deliverability Health Check → Blacklist Checker →

Why We Built This Tool

Manual DNS record construction is error-prone — one typo in a qualifier or include: mechanism breaks the entire record. This generator builds the exact syntax for every major ESP so teams can add new services without risking syntax errors or exceeding the 10-lookup limit.

What Goes Wrong Without This

SPF records fail silently for two reasons: either the syntax is wrong, or the lookup count exceeds 10. A PermError fails the same as no SPF — unauthorized senders pass through and legitimate senders get filtered. Teams often don't catch this until emails start bouncing from major ISPs.

Who This Tool Is For

E-commerce & DTC Brands

Teams using multiple ESPs (Klaviyo, SendGrid, Google Workspace, HubSpot) who need exact DNS syntax to avoid the 10-lookup limit.

Email Marketing Agencies

Agencies setting up or auditing client SPF records who need to generate correct syntax fast without manual DNS knowledge.

B2B SaaS & Outbound Teams

Teams integrating sales outreach tools that need to add new ESP mechanisms to existing SPF records without syntax errors.

Frequently Asked Questions

What is an SPF record?
SPF (Sender Policy Framework) is a TXT record published on your domain that lists all the servers and ESPs authorized to send email on your behalf. ISPs use it to verify you really sent the email.
Why does DNS lookup count matter?
SPF can only do 10 DNS lookups maximum. If your record has more than 10 lookups, receiving servers return a PermError, which fails SPF the same as having no SPF at all. Each 'include:' mechanism counts as one lookup.
Should I use -all or ~all?
Use -all (hard fail) to reject unauthorized senders completely. Use ~all (soft fail) temporarily while testing to ensure no legitimate senders are missed. Once verified, always move to -all for maximum protection.
Do I need an InboxEagle account to use this tool?
No. This tool is completely free and requires no account or sign-up. InboxEagle provides it as a standalone resource for email marketers, developers, and agencies.

Your SPF Record Breaks Every Time You Add an ESP

InboxEagle detects changes to your SPF record within hours of publication and alerts you if a new mechanism pushes you over the 10-lookup limit. Teams using multiple ESPs rely on this to catch configuration drift before it causes delivery failures.

Start Free 14-Day Trial

No credit card required · Cancel anytime