Email

SPF Record Generator

SPF Record

Build your SPF record

Add your own mail servers, then your third-party senders, then choose how strictly to fail everyone else.
DomainrequiredWhat's this?
The domain you send mail from. The record is published as a TXT record at its root.
Publishes at the root of yourdomain.com. “Look up existing” fetches the record already published so you can edit it.
Already have a record?paste · optionalWhat's this?
Paste an SPF record from anywhere — another domain, a vendor’s guide, a draft — to prefill the wizard with it.
Step 1 of 4

Finish the wizard to build your record

Work through the four steps above, then press Generate on the last step to produce your SPF record.

Tool features

Everything you need to build and publish a correct SPF record
4 checks

Guided four-step wizard

Domain, your own servers, third-party senders, then the policy — no syntax to memorize

One-click providers

Google Workspace, Microsoft 365, SendGrid, SES and more added as correct include mechanisms

Lookup-limit tracking

Counts DNS-querying mechanisms as you build so you never publish a record that permerrors

Validation & deployment

Every record ships with an RFC 7208 checklist and step-by-step publishing instructions

What is an SPF record & how it works

Authorizing the servers allowed to send your email

An SPF (Sender Policy Framework) record is a DNS TXT record that lists which mail servers are allowed to send email for your domain. Receiving servers check it to decide whether a message really came from you — a first line of defence against spoofing and a building block for DMARC.

This generator builds a valid SPF record step by step: add your sending sources (IPs,include: mechanisms for providers like Google or Microsoft, and MX/A records), then choose how strictly to fail unlisted senders. It handles the syntax and the all-important lookup-count limit so you get a record that works the first time.

Every field in the wizard — the a and mx switches, the IP list, provider includes and the all policy — is explained one by one in SPF Generator: Every Input Explained — the same copy behind every “What's this?” link above.

include:
Delegates authorization to another domain's SPF record — how you authorize providers like Google Workspace.
~all vs -all
~all soft-fails unlisted senders (mark as suspicious); -all hard-fails them (reject). -all is stricter.
10-lookup limit
SPF allows at most 10 DNS lookups. Exceeding it breaks the record, so keep includes lean.

How to use this tool

Build and publish an SPF record in four steps
1
Enter your domain
Start with the domain you send email from, for example example.com.
2
Add your sending sources
Include your mail providers, server IPs, and any MX/A mechanisms that send on your behalf.
3
Choose an enforcement policy
Pick ~all (soft-fail) while testing, or -all (hard-fail) once you're confident all senders are listed.
4
Publish the record
Copy the generated TXT record and add it to your domain's DNS at the root (@).

Related tools

Keep debugging with tools from the same suite
4 tools
SPF Lookup
Check Sender Policy Framework (SPF) records for email authentication and mail server authorization
SPF Validator
Validate SPF record syntax and check for configuration errors and best practices
DMARC Generator
Generate DMARC policy records for email authentication with policy configuration options
MX Lookup
Find mail exchange (MX) records for email server configuration and priority

Frequently asked questions

Common questions about SPF records
5 Q&A

~all is a soft fail — mail from unlisted servers is accepted but marked suspicious. -all is a hard fail — it tells receivers to reject unlisted senders outright. Use ~all while testing, then move to -all for full protection.

No. A domain must have exactly one SPF (TXT starting with v=spf1) record. Multiple SPF records are invalid and cause authentication to fail — merge them into a single record.

SPF evaluation is capped at 10 DNS lookups (from include, a, mx, and similar mechanisms). Exceeding it results in a permerror. Keep your includes minimal, or use SPF flattening if you hit the limit.

Add it as a TXT record on the root of your domain (host @ or the bare domain), with the value being the generated v=spf1 ... string.

SPF is one piece. For full protection you also need DKIM and a DMARC policy — DMARC uses SPF and DKIM results to decide how to handle mail that fails authentication.