SPF Record Generator and Checker
Check your SPF record through every include with the 10-lookup count receivers use. Then build or merge one record from your senders’ official includes. Free, no sign-up, nothing stored.
Your Domain
Try it: salesforce.com, paypal.com
Build or Merge Your SPF Record
Tick who sends email for you. Each include comes from the sender’s own documentation; senders that need none say so. Lookups are counted live.
Separate with commas or spaces; IPv6 works too.
Any other include, exists or redirect. A bare domain becomes an include.
Both work with DMARC. Microsoft recommends -all; Google’s example uses ~all.
Merge several SPF records into one
Every mechanism is kept once; the endings become one.
What Is SPF?
SPF (Sender Policy Framework) is a TXT record on your domain that lists the servers allowed to send email for it. Receivers check the sending server against the domain in the return-path (the envelope sender); the From address people see is DMARC’s job.
That is why DMARC needs SPF or DKIM to pass for a domain that matches From. With Account Engagement (Pardot) and most email tools that is DKIM, because they send with their own return-path.
- Lives at
- the domain itself (@)
- Starts with
v=spf1- Records per name
- exactly one
- Lookup limit
- 10, and 2 without an answer
- Standard
- RFC 7208 (2014)
The 10-Lookup Limit
Receivers stop at 10. Above that, SPF is a permanent error and the mail fails SPF as if you had no record.
- 10DNS lookups per check, each include with everything inside it
- 2Lookups without an answer (void lookups)
| Part | Costs a lookup | Note |
|---|---|---|
include: | Yes, plus everything inside it | The usual reason for too many lookups |
a, mx | Yes | mx may lead to at most 10 mail servers |
ptr | Yes | Should not be used (RFC 7208, 5.5) |
exists: | Yes | Often with macros, as in Salesforce’s include |
redirect= | Yes | Ignored when the record has an all |
ip4, ip6, all | No | Addresses cost nothing |
Lookups without an answer (void lookups) are limited to two.
Fix Too Many Lookups
In this order. Most records get under 10 with the first three.
- 1
Find What Costs the Most
Check your domain above: the tree shows each include with its own and its total lookups.
- 2
Remove Senders You Left
Old newsletter tools and CRMs often stay in the record for years. Google advises removing includes of services that no longer send.
- 3
Drop Includes Nobody Needs
Pardot, Marketing Cloud Next, Mailchimp, Postmark and Klaviyo pass SPF with their own return-path. Their include only adds lookups.
- 4
Give a Sender Its Own Subdomain
news.example.com gets its own SPF record with its own 10 lookups. Microsoft suggests this for bulk mail.
- 5
Flatten Only as a Last Resort
Replacing includes with IP addresses saves lookups but breaks when a vendor changes servers. The checker shows what it would mean for your record.
The Right Include per Sender
From each vendor’s own documentation, checked 16 and 17 October 2026. Several need no include at all.
| Sender | What to add to SPF | Source |
|---|---|---|
| Google Workspace | include:_spf.google.com | Google, Oct 2026 (opens in a new tab) |
| Microsoft 365 | include:spf.protection.outlook.com | Microsoft, Jul 2026 (opens in a new tab) |
| Salesforce (Sales and Service Cloud) | include:_spf.salesforce.com | Salesforce, Oct 2026 (opens in a new tab) |
| Account Engagement (Pardot) | Nothing: passes SPF on its own | Salesforce, Apr 2026 (opens in a new tab) |
| Marketing Cloud Next | Nothing: the bounce CNAME covers SPF | Salesforce, Sep 2026 (opens in a new tab) |
| HubSpot | include:<account>.spf0X.hubspotemail.net, per account | HubSpot, Sep 2026 (opens in a new tab) |
| SendGrid | include:sendgrid.net, only with automated security off | Twilio, Aug 2026 (opens in a new tab) |
| Mailgun, Mailjet | include:mailgun.org, include:spf.mailjet.com | Mailgun (opens in a new tab), Mailjet, Jul 2026 (opens in a new tab) |
| Zoho Mail | include:zohomail.com | Zoho, Oct 2026 (opens in a new tab) |
| Zendesk, Freshdesk | include:mail.zendesk.com (smtp. and support.zendesk.com are outdated), include:email.freshdesk.com | Zendesk, Oct 2026 (opens in a new tab), Freshdesk (opens in a new tab) |
| Mailchimp, Postmark, Klaviyo, Brevo | Nothing: their own return-path or DKIM covers it | Mailchimp (opens in a new tab), Postmark (opens in a new tab), Klaviyo (opens in a new tab), Brevo (opens in a new tab) |
| Amazon SES | Nothing on the domain; with a custom MAIL FROM, include:amazonses.com on that subdomain | AWS (opens in a new tab) |
SPF Flattening, Honestly
It fixes the count and creates a new risk.
- What it does
Addresses Instead of Includes
Flattening replaces includes with the IP addresses behind them, so they cost no lookups.
- The risk
Vendors Change Servers
A flattened record is a snapshot. When a sender adds a server, its mail fails SPF until you update. Microsoft says not to flatten Microsoft 365 and to review flattened entries at least quarterly.
- Our advice
Remove, Skip, Split First
Most records get under 10 without it. dmarcian dropped its own flattening feature and calls it a stop-gap. Records with macros, such as Salesforce’s, cannot be flattened at all.
~all, -all or Something Else?
The ending says what happens to servers the record doesn’t list. With DMARC, DMARC decides what happens to the mail.
-all. Fail: other servers are not allowed. Microsoft recommends it.~all. Soft fail: probably not allowed. Google’s example record ends this way.?all. Neutral: no statement about other servers. Avoid it.+all. Pass: every server on the internet may send as you. Never use it.
For Pardot and Marketing Cloud Next
What Salesforce’s help pages say about SPF, checked 17 October 2026.
Account Engagement (Pardot)
Pardot mail passes SPF on its own: Salesforce says no SPF setup is needed, and aspmx.pardot.com is not in current help. The return-path is a Salesforce domain, so SPF doesn’t match your From address; DMARC passes through DKIM (selector 200608).
Marketing Cloud Next
SPF comes with the bounce CNAME of the authenticated domain; Salesforce manages it and says no extra SPF record is needed. Email sent from Sales or Service Cloud is different: it needs include:_spf.salesforce.com.
SPF Record FAQ
Short answers to what people ask about SPF.
Can I have two SPF records?
No. If a name has more than one record starting with v=spf1, SPF returns a permanent error for every message. Merge them into one.
How do I combine two SPF records?
Paste both under “Merge several SPF records” in the generator. Every mechanism is kept once and the record gets one ending. Then check the count: two records with 6 lookups each make 12.
How do I fix “SPF permerror: too many DNS lookups”?
Remove includes of services you left, drop includes for senders that need none (Pardot, Marketing Cloud Next, Mailchimp), and move a sender to its own subdomain. Flatten only as a last resort.
Should my SPF record end in ~all or -all?
Both work with DMARC. Microsoft recommends -all; Google’s example uses ~all. Never use +all.
Do I need to add Pardot to my SPF record?
No. Salesforce says Account Engagement mail passes SPF on its own. What matters for DMARC is the DKIM key (selector 200608).
Do subdomains use the domain’s SPF record?
No. SPF is checked for the exact domain in the return-path, so a subdomain that sends needs its own record.
What is a void lookup?
A lookup that finds nothing, such as an include to a name that no longer exists. Receivers should fail SPF after more than two.
Is the domain I check stored?
No. Your browser sends the names to our server, which asks a public DNS resolver. Nothing is saved, no domain is logged, and the resolver never sees your IP address.
More Free Tools
We Make Salesforce Marketing Work for You
Talk to a certified consultant, not a salesperson, and leave the first call knowing your next step.