An SPF generator is a concatenator with opinions. It should emit one v=spf1 string, refuse +all, and tell you when you are about to blow the 10 lookup cap. It should not pretend it published anything. DNS is still your job.
The usual failure is not syntax. It is two records, or a missing ESP after a platform change, or stacking every SaaS include “just in case” until evaluation returns permerror. This tool builds one record and counts the lookups with the same parser the SPF checker uses.
One record, every sender
Google Workspace, Microsoft 365, Klaviyo, Mailchimp, a dedicated IP: they all go in the same TXT. If a record already exists, you edit it. You do not add another. Two SPF records is a fail even when each one looks fine on its own.
Includes vs IPs
include: is how ESPs authorise themselves. Each one costs a lookup, and nested includes behind Google or Microsoft count later, which this generator does not flatten. Direct ip4 and ip6 terms are free. If you run your own sending IPs, list them that way.
Klaviyo is the awkward one. A branded sending domain usually aligns SPF through a return-path CNAME, so an apex include is not always required. The chip is here because plenty of setups still want _spf.klaviyo.com on the root. Confirm against what Klaviyo is actually showing you.
Start with ~all
-all is the destination, not the onboarding setting. If you hard-fail before every sender is listed, you will reject your own mail and then spend a week deciding SPF is cursed. Generate with ~all, watch DMARC reports, then tighten.
The longer version of how this sits next to DKIM and DMARC is already written: SPF, DKIM, and DMARC.