Build one draft SPF record from the sending IPs and include domains you provide.
Your entries stay in this tab. Not sent to or saved by Sky. Export or print before closing or reloading, or your entries will be lost. Do not include passwords, API keys, recipient lists or private logs.
This tool builds draft SPF text from the IPv4, IPv6, and include domains you enter. Compare it with your current DNS policy before publishing.
The heading is SPF Record Generator. A successful draft without includes has info status and this summary: Draft SPF text generated from the supplied sending sources. Review it against the existing record before publishing. With includes, status becomes warning because their DNS records are not checked.
IPv4 sources, IPv6 sources, Include domains, Direct DNS-query terms, and Final policy show what went into the draft. Direct DNS-query terms counts only the includes you entered, shown as a count of 10. It does not include terms inside those records or the rest of your policy.
Drafts show Draft only — review before publishing. With an include, Inherited DNS terms are unknown appears too. The record starts v=spf1, lists ip4, ip6, and include terms, then ends with ~all or -all. The tool does not query DNS or test a message.
Input errors have error status. Empty lists show No sending sources supplied and ask for at least one IPv4, IPv6, or include-domain source. Invalid entries show Invalid SPF source input; use its detail to correct them. Direct DNS-term limit exceeded means too many direct includes.
Usual cause: The generator uses only the sources entered. It cannot read or merge your published DNS policy.
Fix: Merge authorized sources into the existing record. Keep one SPF record at that DNS name, and verify it before replacing anything.
Usual cause: The generator does not query included records, which can contain more DNS-querying terms.
Fix: Inspect included policies and the rest of your record. SPF evaluation allows 10 DNS-query terms, including include, a, mx, ptr, exists, and redirect.
Usual cause: Google says SPF should include all senders for your domain. The tool cannot discover senders you did not enter.
Fix: Inventory legitimate sending systems. Add the provider's documented include domain or sending IP to the existing policy, then check the full lookup count.
Usual cause: Softfail weakly indicates a host is probably unauthorized; fail explicitly says it is not authorized.
Fix: Confirm all senders and discuss the intended policy with your DNS operator. Receivers decide how SPF results affect handling.
Usual cause: TXT data can contain strings joined without spaces. A single character string is limited to 255 octets.
Fix: Keep SPF in one TXT record. If the interface splits the value, confirm the joined text is correct and required spaces between terms remain.
v=spf1 ip4:192.0.2.10 include:example.net ~allThis sample uses a documentation IPv4 address and shows include syntax with example.net; the tool does not check whether that domain publishes an SPF policy. A host matching neither source receives softfail from ~all. Verify every source and inspect included policies before using a real record.
Ask the provider for its exact SPF source. Add that include domain or authorized sending IP to your current v=spf1 record; do not publish a second SPF record for the same name. Review existing terms and included policies against the DNS-query limit.
The generator labels these Softfail (~all) and Fail (-all). RFC 7208 defines softfail as a weak indication that a host is probably unauthorized, while fail explicitly says it is not authorized. Confirm your senders and policy first; recipient handling varies.
Review include, a, and mx terms and the records they reference. They require DNS queries; ip4 and ip6 do not count toward the ten-term limit. Remove only sources confirmed as unused, then check the complete policy again.
Publish SPF as a DNS TXT record at the domain name whose sending policy you are setting, using your DNS host's control panel. Keep one SPF policy at that name. If the panel splits the TXT value, DNS joins the strings without spaces.