generate_spf
Build an SPF (Sender Policy Framework) record — the DNS TXT record that lists which servers may send mail for a domain. Pass the senders as mechanisms: include for a provider's own SPF (Google Workspace is _spf.google.com, Microsoft 365 is spf.protection.outlook.com, SendGrid is sendgrid.net), ip4/ip6 for your own servers, plus useMx/useA to authorise the domain's own MX or A records. The policy decides what receivers do with mail from anywhere else: 'fail' (-all, the production choice), 'softfail' (~all, for testing), 'neutral', or 'pass' (+all, which authorises the entire internet and should never be published). SPF is limited to ten DNS-triggering terms during recursive evaluation. This pure builder counts direct mechanisms; include and redirect targets can add nested lookups, so validate the published record with check_spf before treating the count as final. Returns the record, direct lookup count, whether that direct count or the 255-character limit is exceeded, plain-language warnings, and the DNS entry to publish. Use check_spf to resolve and validate a live record, and flatten_spf only when an existing record is over the limit. Nothing is looked up or stored — this is computation only.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| useA | No | Authorise the domain's own A/AAAA records. Costs one DNS lookup. | |
| useMx | No | Authorise the domain's MX hosts. Costs one DNS lookup. | |
| policy | No | What receivers do with everything else: fail (-all) for production, softfail (~all) while testing. Defaults to fail. | |
| mechanisms | No | Senders to authorise, in the order they should appear in the record |