Should I use ~all or -all at the end of my SPF record?

Modern email authentication best practice paired with DMARC recommends using `~all` (SoftFail). It allows legitimate forwarded emails to be authenticated by DKIM without getting immediately rejected by strict SMTP servers.

Updated: August 2026 • Verified v1.2

DNS SPF Record Generator & Policy Builder

Internet & NetworkNetwork

Local Browser Execution: Your input is processed locally in your browser and is not sent to UTL servers.

SPF Syntax Synthesis: v=spf1 [mx] [a] [include:providers...] [ip4/ip6:ranges...] [policy_all]

Was this calculation helpful?

Understanding Your Results

Constructs valid RFC 7208 SPF TXT records, generates BIND zone file lines, tracks total DNS lookup mechanisms against the 10-lookup limit, and provides terminal `dig` verification commands.

Practical Guidance & Next Steps

Never create more than one SPF TXT record for a domain; having multiple SPF records causes permanent SPF validation failure (PermError) across all email providers.

What is this?

A domain security utility that constructs RFC 7208 compliant SPF email authentication records.

How does it work?

1. Enter your domain name and select your email providers (Google, Office 365, SendGrid, etc.). 2. Add custom relay IP addresses and choose a fail policy (~all or -all). 3. Copy the DNS TXT record and BIND zone entry in 1 click.

Why use it?

Prevents email spoofing and ensures reliable inbox deliverability by eliminating syntax errors in SPF records.

Technical Scope & Calculation Limitations

Generates RFC 7208 standard SPF syntax.

Frequently Asked Questions

RFC 7208 specifies that an SPF check must not perform more than 10 DNS lookups (from `include`, `a`, `mx`, `ptr`, and `exists` mechanisms). Exceeding 10 lookups causes receiving mail servers to return an SPF PermError and reject or spam your email.

Windows Desktop & Widget Options