Free SPF Flattener

A Sender Policy Framework (SPF) record is a DNS TXT record that lists all IP addresses and mail servers authorized to send email on behalf of your domain. When a receiving server gets an email claiming to be from your domain, it checks your SPF record to verify the sending IP is authorised. A missing or incorrect SPF record is one of the most common reasons legitimate emails land in spam folders or get rejected outright.

A PermError typically means your SPF record has a syntax error or exceeds the 10 DNS lookup limit. The SPF specification limits records to 10 mechanisms that require DNS lookups (include, a, mx, ptr, exists). Exceeding this causes a PermError and authentication failures. Use our SPF Flattener to resolve this by replacing include chains with flat IP ranges. A TempError usually indicates a DNS timeout during validation — retry after a short wait.

Add each sending service as an include mechanism in your SPF record. For example: v=spf1 include:_spf.google.com include:sendgrid.net include:spf.protection.outlook.com -all. Be careful — each include counts towards the 10-lookup limit. Use our SPF Generator to build the record and SPF Checker to validate it before publishing to DNS.

The qualifier at the end of your SPF record defines what happens to emails that fail SPF: -all (hard fail) tells receivers to reject unauthorized senders; ~all (soft fail) marks them as suspicious but usually delivers; +all allows anyone to send (never use this); ?all is neutral. Use -all or ~all in production — -all provides the strongest protection once you have verified all your sending sources.