SPF

Analysis and generation, with the real count of DNS lookups triggered.

Build a record

Addresses are placed before the a and mx mechanisms: a sender recognised by its address then triggers no lookup at all.

Authorised senders

The domain's own addresses (a mechanism)

The domain's receiving servers (mx mechanism)

IP addresses

One per line. CIDR notation accepted. These mechanisms consume no DNS lookup.

Providers (include:)

One per line, without the include: prefix. Each costs one lookup, and those it triggers in turn count too.

Treatment of other senders

-all — reject — the only value that really protects

~all — accept but mark — while rolling out

?all — draw no conclusion — equivalent to having no policy

The +all mechanism is not offered: it authorises the entire world to forge the domain.