Should I end with ~all or -all?

Start with ~all (softfail). Use -all once you are sure every legitimate sender is listed.

How do I stay under 10 lookups?

Remove includes for services you no longer use, or flatten includes into ip4/ip6 ranges and keep them updated.

SPF Generator

An SPF record must list every service that sends mail for your domain in one TXT record while staying under 10 DNS lookups. This generator builds a valid record from the senders you pick and counts the lookups as you go.

When to use this: You are publishing SPF for the first time or adding a new sending service to an existing record. Command prefix spf-generator:

Authorize the domain’s A record (a)Authorize the domain’s MX hosts (mx)IPv4 addresses / ranges (ip4:)IPv6 addresses / ranges (ip6:)Includes (include:)Other terms, kept as they are (exists:, a:host, redirect=…)Default policy (all)

v=spf1 mx include:_spf.google.com ~all

DNS lookups:2 / 10

Lookup limit & flattening

Includes nest: the count above counts each include once. Run SPF Check on your domain after publishing for the exact total.

Count exact lookups (SPF Check)

Publish as a TXT record on your root domain. Only one SPF record is allowed per domain.

About the SPF Generator

Build a valid SPF record from your mail sources, see the lookup count as you go, and get advice when you are near the 10-lookup limit.

FAQ

Should I end with ~all or -all?: Start with ~all (softfail). Use -all once you are sure every legitimate sender is listed.
How do I stay under 10 lookups?: Remove includes for services you no longer use, or flatten includes into ip4/ip6 ranges and keep them updated.