NFlow
nflowtech.com

Free SPF Checker & Record Generator

Check your current SPF record or build a new one with a visual mechanism builder, live validation counters, and plain language guidance.

SPF DNS TXT Email Auth
Your Domain
Email Providers and Senders

Select every service that sends mail from your domain.

Add Custom Provider

Add an email service not listed above. It will appear in the checklist alongside the built-in providers.

Add Your Own Sender

Paste any extra sender. Each line or comma separated entry can be an IP such as 203.0.113.10, a range such as 198.51.100.0/24, a domain such as esp.com, or a full include such as include:esp.com.

Domains are turned into include mechanisms automatically. Invalid entries are flagged after you generate.

Fail Policy

Why SPF Is the First Layer of Email Authentication

SPF is the list of servers allowed to send email for your domain. It is published as a TXT record in DNS, and receiving servers check it every time a message arrives. If the sending server is on the list, the mail passes. If not, it is a candidate for spam or rejection. That single lookup is the first line of defense against forged mail.

The cost of getting it wrong cuts both ways. A record that is too strict blocks legitimate senders and breaks deliverability. A record that is too loose lets spoofers through and erodes trust. The most common failure is the lookup limit: DNS lookups inside an SPF record are capped, and exceeding the cap makes the whole record invalid.

SPF works with DKIM and DMARC, not instead of them

DMARC policy enforcement requires the mail to pass one of the two authentication checks, and SPF alignment must match the domain in the envelope. Building a clean SPF record is therefore also a prerequisite for the DMARC reject policy that fully protects your domain.

How to Check and Build Your SPF Record

Start by entering your domain and clicking Check SPF. The tool queries your current TXT records and shows whether an SPF record exists, what it allows, and whether it has problems. A missing record is the most common finding, followed by records with too many lookups.

In the generator, add each legitimate sending source. Tick the provider checkboxes, add any custom provider with its include domain, and paste extra senders as IPs, ranges, domains, or include mechanisms. The live counters show your lookup total and character count, and warnings appear if you approach the limits.

When the record is complete, copy the generated value and publish it at the root of your domain as a TXT record. Wait for propagation, then run the checker again to confirm it parses correctly. Keep the record updated whenever you add a new email service.