Free SPF Record Generator
Tell us which services send mail as your domain and get a single SPF record to paste into your DNS, with the checks that catch the mistakes receivers punish.
Building your record...
Could not build the record
The @ symbol means the domain itself. SPF belongs on the exact domain in your envelope sender address.
Mechanisms in this record that cost a DNS lookup. Includes can add more of their own, which count against the same limit of ten.
Nothing to flag in this record.
What an SPF Record Generator Does
An SPF record generator writes the TXT record that lists every server allowed to send mail as your domain. Receivers compare the sending server against that list and use the answer in their filtering and in DMARC. A record always begins with v=spf1 and ends with a rule for everyone not listed.
The hard part is not the syntax. A domain may publish only one SPF record, so each new service has to be merged into the existing one, and the DNS lookups that record costs are capped. This generator merges your senders into one record and counts the lookups it adds directly. To see how a published record behaves, use the email deliverability checker.
- List every service that sends as your domain: your mailbox provider, newsletters, invoicing, your helpdesk.
- Tick the ones shown, and add any others as include hosts or IP addresses.
- Choose how receivers should treat everyone else, then generate.
- Publish the result as a TXT record on your domain, replacing any existing SPF record.
What the generator checks for you
- One record: every sender lands in a single line, because two SPF records is an error receivers will not resolve for you.
- The lookup limit: direct lookups are counted against the limit of ten, with a warning that each include can add more.
- The ending: the record closes with the all rule you chose, and a weak one is flagged.
SPF Mechanisms the Generator Uses
A record is read left to right, and the first match wins. These are the terms you will see in the output.
| Term | Matches | When to use it | Direct lookups |
|---|---|---|---|
| include: | Another domain's SPF record | How a third-party service authorises its own servers. Use the exact host from the provider's documentation. | 1, plus its own |
| ip4: / ip6: | Specific addresses | For servers you control with a fixed address. These cost no lookups, so they are the way out of a lookup problem. | 0 |
| a / mx | Your own hosts | Matches the address of your domain, or of your MX servers. Tick these only if those machines actually send mail. | 1 each |
| all | Everyone else | Always last. -all fails unlisted senders, ~all soft fails them and ?all stays neutral. | 0 |
How to Use the Output
The record, where it goes, and what it costs in lookups.
Before you publish
The warningsOne sentence for each risk in this record. The include warning appears on most records, because no generator can know what a provider's record will cost on the day a receiver reads it.
The TXT record
The valueOne line, starting with v=spf1 and ending with your all rule. If you already have an SPF record, this replaces it. Do not publish both.
The host
The nameSPF sits on the domain itself, usually entered as @. A subdomain that sends its own mail needs its own record, because SPF is not inherited.
Direct lookups and publishing
The last stepThe count covers the terms in this record only. Publish it, then test the live record to see how the includes behave, and keep the list short.
The Limit of Ten DNS Lookups
SPF caps evaluation at ten DNS lookups (RFC 7208, section 4.6.4). Past that, the receiver returns a permanent error and SPF fails for every message, including your own. The include, a, mx, exists and redirect terms all count; ip4, ip6 and all do not.
Includes are where records go over. A single include can pull in further includes behind it, and a provider can change that on its side at any time. That is why this tool reports direct lookups and does not guess a total.
Choosing the All Rule
The all rule decides what happens to servers not on your list, and on its own it is a hint to receivers. Enforcement comes from a DMARC policy, which the DMARC generator can build.
In practice:
- Use ~all while you are still finding every service that sends as you.
- Use -all once you are confident in the list, or for a domain that sends no mail.
- Avoid ?all, which says nothing useful about unlisted senders.
- Avoid +all completely, since it authorises every server on the internet. This generator does not offer it.
Where New SPF Records Go Wrong
A valid record can still fail in use. Look out for these:
- Publishing a second record for a new service. Two records starting v=spf1 is a permanent error, so merge the new include into the existing line. A DNS lookup shows what is already there.
- Forgetting a sender. Any service left off your list fails SPF, and if a strict DMARC policy is in force its mail can be rejected. Invoicing and helpdesk tools are often missed.
- Ticking a and mx out of habit. Each costs a lookup, and neither helps if your website and mail servers do not send mail.
- Assuming SPF covers subdomains. It does not. A subdomain that sends mail needs its own record.
Why an SPF Record Matters
It names your real senders
Without SPF, receivers cannot tell your servers from anyone else's, and spoofed mail has one less thing to fail.
A broken record hits real mail
One extra record or too many lookups turns SPF into an error for every message you send, not just the forged ones.
DMARC depends on it
DMARC passes on aligned SPF or aligned DKIM. A correct SPF record gives each message one more way to pass.
It records who sends as you
Writing the list is often the first time anyone sees how many services send mail in the company's name.
Who Generates SPF Records
Anyone adding a sender, or cleaning up after several.
IT & Email Admins
Rebuild a record that has grown by accident, and retire the services nobody uses any more.
For DNS monitoringSecurity Teams
Give every non-sending domain a record that allows nothing, so it cannot be used to pass SPF.
For IT & MSPsEmail Marketers
Add a new sending platform to the record before the first campaign goes out.
For marketersAgencies
Send a client one line to paste, with every service you set up for them included.
For agenciesWhat to Do After Generating
SPF is one of three records your mail needs.
Test the published record
Read SPF with DKIM, DMARC and MX to see the whole mail setup.
Email deliverability checkerAdd a DMARC policy
Tell receivers what to do with mail that fails, and start collecting reports.
DMARC generatorLook for an old record
See every TXT record on the domain before you publish a new SPF line.
Run a DNS lookupWatch for changes
Get alerted when the record changes, a second appears, or the lookups pass the limit.
Email auth monitoringFrequently Asked Questions
Common questions about creating and publishing an SPF record.
How do I create an SPF record?
List every service that sends mail as your domain, tick or enter them above and generate. Then create a TXT record on your domain, usually with @ as the name, and paste the value in. If an SPF record already exists, replace it.
What does an SPF record look like?
A single line such as v=spf1 include:_spf.google.com ~all. It starts with the version, lists who may send, and ends with a rule for everyone else.
Can I have two SPF records?
No. A domain with more than one SPF record returns a permanent error, so SPF fails. Merge the senders into one record, which is what this generator does when you tick several services.
What is the SPF limit of 10 lookups?
SPF evaluation may trigger at most ten DNS lookups. include, a, mx, exists and redirect each count, including those nested inside an include. Over the limit, receivers return a permanent error.
Why does the generator only count direct lookups?
Because it reads no DNS. It counts the terms in the record it built. Each include can add lookups of its own, and a provider can change those at any time, so a figure from here would not be a real total.
Should I use -all or ~all?
Use ~all while you confirm your sender list, and -all when you are confident in it. With an enforced DMARC policy the practical difference is small, because DMARC decides what happens to failing mail.
Do I need SPF if my domain sends no email?
Yes. Publish v=spf1 -all, which says nothing may send as this domain, and pair it with a DMARC policy of reject. Generate with no senders and the -all option to get exactly that.
How do I add a service that is not listed?
Find the SPF include host in that provider's documentation and enter it under other include hosts. If the service gives you IP addresses instead, enter those in the IPv4 or IPv6 field.
Does SPF cover my subdomains?
No. SPF is checked on the exact domain in the envelope sender, so each subdomain that sends mail needs its own record.
Start Monitoring & Catching Domains Today
Join founders, agencies, and domainers already protecting their portfolio. Your first 5 domains are free.
No credit card required • Cancel anytime
Guides for domain operators
Deep dives on domain names, DNS, SSL, acquisitions and portfolio management.
All guides →
4 Letter Domains: The Complete LLLL Investing Playbook
4 letter domain names represent one of the most liquid segments of the domain aftermarket. All 456,976 possible .com combinations are registered.
.SI Domain: Slovenia's 30-Year-Old ccTLD Is Suddenly Super Intelligence
What is the .SI domain? Learn how Slovenia's country-code TLD went from 10 registrations in 1992 to a 2,199% surge in September 2026, and why 'super intelligence' made .SI the new .AI.
Infringing Domains: Detecting, Monitoring, and Recovering
Your domain is your storefront. Every day, someone registers a lookalike of it, to skim your traffic, phish your customers, or hold it for ransom. This guide covers what infringing domains are, how to find them before they hurt you, and exactly what to do when you do.