grimDMARC
|
Log in

SPF Builder & Validator

Build a new SPF record from scratch, or paste one to check it against RFC 7208 syntax.

Email providers

Select every platform that sends email on behalf of this domain.

Custom sources

Enforcement policy

Generated SPF record

0 / 10 DNS lookups
v=spf1 -all

Publish this as a single TXT record at the root of your domain (@). Nothing above is sent anywhere — it's generated entirely in your browser.

What this tool does

The builder assembles a valid SPF TXT record from the providers and sources you select, and the validator checks the syntax of a record you already have — both run entirely in your browser, so nothing you type is sent to a server or logged.

  • Build a record — pick the email providers that send on your behalf (Microsoft 365, Google Workspace, SendGrid, Mailchimp and more), add custom includes, IPv4/IPv6 ranges, and choose an enforcement policy. A running DNS lookup counter warns you before the record would exceed the RFC 7208 10-lookup limit.
  • Validate a record — paste in an existing record and get a token-by-token breakdown plus any syntax errors, without needing to look the record up from DNS first.

Once published, use the SPF Analyzer to confirm the live record resolves correctly over DNS and stays under the lookup limit. To build the domain's DMARC record too, use the DMARC Builder.

Frequently asked questions

Is the SPF builder free?

Yes. Building or validating an SPF record is free and doesn't require an account or email address.

Does the builder check the 10 DNS lookup limit?

Yes. As you add email providers, custom includes, and mechanisms like a or mx, the builder tracks the running DNS lookup count against the RFC 7208 10-lookup limit and warns you if the generated record would exceed it and likely cause a PermError.

What's the difference between the builder and the analyzer?

The builder creates a new record from your selected providers and sources, or validates syntax you paste in, without touching DNS. The SPF Analyzer instead resolves a real domain's currently published record over live DNS and reports on its actual lookup count and provider detection.