Free Tool · Email Authentication
SPF Analyzer & Record Builder
Check whether your domain’s SPF record actually protects you — and if it’s over the hidden “10 DNS lookup” limit that silently breaks it. Then build one clean, correct record from a checklist, so you never hand-edit an SPF string again.
🔒 This tool looks up your domain’s public DNS records using Cloudflare’s DNS-over-HTTPS, straight from your browser. Nothing you type is sent to ThouShaltNotClick’s servers.
Build a clean SPF record
Tick everyone who sends email as your domain. We’ll assemble one correctly-ordered record.
Who sends mail as your domain?
Some services send from their OWN domain, so you need no SPF entry for them: FACTS/RenWeb, Remind, Flocknote, Vanco, Square. And Resend, Postmark and similar authenticate on a dedicated "send." subdomain — set those up using the provider's own DNS instructions, not on this record.
What should happen to mail from servers NOT listed?
Your new SPF record
0 direct lookups · 11 chars
v=spf1 ~allHigh: This record authorizes NO senders — publishing "v=spf1 ~all" would make ALL your mail fail SPF. Tick at least one provider, or add your own IP/mx, before you publish.
Before you publish: this replaces your domain’s existing SPF TXT record — don’t add it alongside the old one (two SPF records is itself a failure). Publish it as a
TXT record at your domain’s root (@). Changes can take up to 48 hours to propagate. If you’re unsure a sender is covered, confirm with that provider before switching to -all.Email authentication is step one.
ThouShaltNotClick trains your people to catch what gets through anyway.