Check your current SPF record or build a new one with a visual mechanism builder, live validation counters, and plain language guidance.
SPF is the list of servers allowed to send email for your domain. It is published as a TXT record in DNS, and receiving servers check it every time a message arrives. If the sending server is on the list, the mail passes. If not, it is a candidate for spam or rejection. That single lookup is the first line of defense against forged mail.
The cost of getting it wrong cuts both ways. A record that is too strict blocks legitimate senders and breaks deliverability. A record that is too loose lets spoofers through and erodes trust. The most common failure is the lookup limit: DNS lookups inside an SPF record are capped, and exceeding the cap makes the whole record invalid.
DMARC policy enforcement requires the mail to pass one of the two authentication checks, and SPF alignment must match the domain in the envelope. Building a clean SPF record is therefore also a prerequisite for the DMARC reject policy that fully protects your domain.
Start in the Checker tab and enter your domain. The tool queries your current TXT records and shows whether an SPF record exists, what it allows, and whether it has problems. A missing record is the most common finding, followed by records with too many lookups.
In the Generator tab, add each legitimate sending source. Choose the mechanism type, then enter the server or IP range it represents. The live counter shows your lookup total and warns before you approach the limit, so you can consolidate includes instead of breaking the record.
When the record is complete, copy the generated value and publish it at the root of your domain as a TXT record. Wait for propagation, then run the checker again to confirm it parses correctly. Keep the record updated whenever you add a new email service.