Build your SPF record step by step

SPF has a hard limit of ten DNS lookups per evaluation. Every include: entry costs at least one lookup, and some platforms use several internally once their own record is fetched. A record that crosses the limit stops being evaluated partway through, and mail can fail SPF for reasons that look baffling from the outside: nothing in the record is wrong, but the budget is spent before the end is reached.

That is why this generator counts as you build. Each sender you add appears in the budget immediately, so you see the cost of your record take shape before it goes anywhere near DNS. IP entries are shown as free because they are: ip4: and ip6: mechanisms are read straight from the record with no further fetching, which makes them a reliable way to authorise known servers without spending budget.

A record that stays comfortably inside the budget keeps a reserve for the day you add one more platform, or your provider changes what their include points at. If the count creeps toward ten, that is the signal to consolidate sends behind fewer, larger includes rather than authorise one more small service.

Once your record is live, the email authentication checker confirms what the world sees when it fetches it, and the DMARC report reading checklist covers what mailbox providers actually did with the mail that claimed to be you. Both are free. From there, DMarcus reads every report your providers send and emails you a weekly verdict — free, no card needed. And if you would rather hand the whole picture to someone who does this daily, the audit maps your live sending streams and builds the record for you.