Sender Policy Framework（RFC 7208）——声明哪些服务器有权使用您的域名发信。可视化配置机制与修饰符，自动生成标准 SPF TXT Record。
RFC 7208 §4.7：-all 之外的策略会显著降低反伪造效果，仅建议在过渡期使用 ~all。
通常无需修改，保持默认 + 即可。
SPF (Sender Policy Framework) uses a DNS TXT record to declare which IPs/servers are authorized to send mail for your domain. The receiving MTA looks up the sender domain's SPF record, matches the connecting IP, and feeds the result to DMARC evaluation.
Record structure: an SPF record starts with v=spf1, followed by mechanisms (ip4/ip6/include/mx/a) and the all modifier, separated by spaces.
Key limit (RFC 7208 §4.6.4): the total number of DNS lookups during SPF evaluation must not exceed 10, otherwise permerror is returned. Each include, mx and a (when resolved) consumes a lookup — this tool counts them in real time.
Publishing: add a TXT record in your domain DNS with an empty (or @) hostname and the generated SPF text as the value. A domain must have exactly one SPF record; multiple records cause permerror.
Note: SPF only validates whether the sending IP is authorized — it does not validate email content. It cannot stop spoofing from unauthorized IPs alone; combine it with DKIM and DMARC (policy quarantine/reject) to effectively curb domain spoofing. After generating, verify with our Email DNS One-Click Diagnostic.
Standards: RFC 7208 (SPF), RFC 7489 (DMARC, the upper-layer consumer of SPF results).