Over 10 lookups
Remove services you no longer use. Flattening (replacing includes with IP ranges) works but breaks silently when providers change IPs.
Tools · Generator
Pick every service that sends email as your domain and copy one valid SPF record, with live lookup counting.
Add this TXT record
@After you publish it, check your domain. DNS changes can take up to an hour to show.
A domain may have only one SPF record, so every service that sends as you belongs in it: your mailbox provider, newsletter tool, CRM and help desk. The generator builds it and counts DNS lookups against the real records, so you stay under 10.
Load your current record first if you have one: the generator ticks the services it recognises and keeps the rest.
Remove services you no longer use. Flattening (replacing includes with IP ranges) works but breaks silently when providers change IPs.
Check every tool that sends as you: CRM, invoices, help desk, forms.
Start with ~all until DMARC reports confirm every sender.
Gmail and Yahoo sender rules
Bulk senders send about 5,000 or more emails a day to Gmail. Cold email teams reach that quickly across mailboxes, so treat the bulk rules as the standard.
Source: Google email sender guidelines
| Rule | Who | Requirement |
|---|---|---|
| SPF or DKIM | All senders | Required |
| SPF and DKIM | Bulk senders | Required |
| DMARC, p=none or stronger | Bulk senders | Required |
| From domain aligned with SPF or DKIM | Bulk senders | Required |
| One-click unsubscribe | Bulk senders, marketing email | Required |
| Spam complaint rate | All senders | Below 0.3 percent |
Tick each service that sends email as your domain, add any own servers, choose ~all, and copy the record into a TXT record on your domain (host @).
Replacing includes with the IP ranges they contain, to save lookups. It works, but the ranges change without notice, so it needs a service that updates them. Removing unused tools is safer.
In the tool’s domain authentication or DNS setup guide. The common ones are in the generator, each checked against live DNS.
@ (or leave it empty), which means the domain itself. Some hosts ask for the full domain name.