Sender inventory first · browser-only draft

SPF record builder for business email.

Turn a checked sender inventory into one reviewable SPF TXT draft. Reconcile it with the live record and every legitimate sender before publishing.

Build a reviewed draft

Private working draft

Inventory every system that sends as your domain.

Stays in this browser
01Domain and current policy

Use the domain after @, without https://, a path or a port.

Paste the current public value so the tool can flag authorisations missing from the draft. Find the current SPF record.

02Known sending services

Select a service only if it sends messages using this domain. Presets are starting values—account-specific DNS shown by the provider remains authoritative.

03Other authorised infrastructure

One domain per line. Use only a value supplied by that provider.

Host-based mechanismsLeave these off unless the domain's A or MX hosts genuinely send outbound mail.

04Unmatched-sender policy
05Review gate

How to use the output safely

A draft starts the change review. It does not finish it.

SPF authorises hosts for an SMTP identity. It does not validate DKIM, DMARC alignment, forwarding behaviour, reputation, message content, delivery or inbox placement.

  1. 01
    Reconcile

    Compare every term in the current record with invoices, forms, CRM, helpdesk, marketing and application senders.

  2. 02
    Confirm

    Use current, account-specific documentation from each provider. Preset domains can change or may not apply to your configuration.

  3. 03
    Change safely

    Keep one SPF TXT policy, capture the old value and TTL, use change approval and retain a tested rollback route.

  4. 04
    Verify

    After propagation, inspect the public policy and test representative legitimate mail flows before tightening the ending.

Primary guidance

Check the sender's own setup screen.

These public references explain why provider and account context matters. The DNS values presented inside the relevant account take priority over a generic preset.

Google Workspace SPF setupSender inventory and one-record guidance Microsoft 365 SPF setupCustom-domain syntax and valid sources Amazon SES SPF guidanceDefault and custom MAIL FROM behaviour Twilio SendGrid authenticationAutomated security and generated DNS records

SPF builder questions

What the generated value means.

Should I create a second SPF record?

No. A domain should publish one SPF policy. Reconcile legitimate senders into that policy rather than adding a second TXT value beginning with v=spf1.

Why does copying stay locked?

The three confirmations make the most common change risks explicit: overlooking an existing record, forgetting a legitimate sender, or relying on a generic provider value that does not match the account.

Does the top-level count prove I am below the SPF limit?

No. It counts visible include, a and mx terms in this draft. Each included provider policy can add further DNS-querying mechanisms, so check the final published policy recursively.

Should I choose softfail or fail?

Softfail is the safer draft default during discovery. A strict fail ending should follow a complete inventory, representative mail-flow testing and an understood rollback plan.