Free Tool

SPF Record Builder

Build valid SPF records while tracking the 10-lookup limit. Select your email providers and we'll generate the correct syntax.

Check Your Current SPF

Look up your domain's existing SPF record before building a new one

DNS Lookups Used1 / 10

Email Service Providers

Select all the services that send email on behalf of your domain

Other Provider

Add any SPF include mechanism. We'll resolve the actual lookup count.

Custom IP Addresses

IP mechanisms don't count toward the 10-lookup limit. Add dedicated sending IPs here.

Catch-all Qualifier

What should happen to mail from unauthorized sources?

Hard Fail (-all)Recommended

Reject unauthorized mail — recommended for production

Soft Fail (~all)

Accept but mark suspicious — good for initial testing

Neutral (?all)

No assertion — testing only, not recommended

Generated SPF Record

v=spf1 include:amazonses.com -all

Add this as a TXT record at your domain's root (@). If you already have an SPF record, you'll need to merge them — you can only have one SPF record per domain.

What counts as a lookup?

include:, a, mx, ptr, and exists mechanisms all require DNS lookups. ip4: and ip6: do not.

Why the 10-lookup limit?

RFC 7208 limits SPF to 10 DNS lookups to prevent denial of service attacks. Exceeding this causes a PermError, which fails DMARC alignment.

What is SPF flattening?

SPF flattening resolves includes to their IP addresses, eliminating lookups. But IPs can change, requiring regular updates or a service like Valimail.

Check your full email setup

Use our Email Deliverability Checker to verify SPF, DKIM, DMARC, and more.

Check Your Domain

Calculate your AWS SES costs

See exactly what you'll pay for email sending plus the full infrastructure — EventBridge, Lambda, SQS, and DynamoDB.

Open Calculator

Want to learn more about SPF and the 10-lookup problem?

Read: The SPF 10-Lookup Limit Explained