SPF Record Generator: Create Your SPF Record Online
Choose who is allowed to send email for your domain, and get a ready to publish SPF record in seconds. This free SPF record generator lets you pick common senders such as Google Workspace, Microsoft 365, SendGrid, Mailchimp and Amazon SES, add your own servers by IP address, and choose how strict the policy is. It counts the DNS lookups as you build, warns you before you pass the limit of 10, and gives you the exact TXT record and the steps to add it. It runs in your browser, so nothing you enter is sent anywhere.
Use it when you set up email for a new domain, add a new sending service, fix mail that lands in spam, or clean up an SPF record that has grown too long.
Use the toolOnly used to personalise the DNS instructions. Nothing is looked up.
Makes the record that tells receivers to reject every message from this domain.
One domain per line, with or without include:. Use the value your provider gives you.
IPv4 and IPv6, one per line or separated by commas. Ranges such as /24 are fine.
Already have a record? Paste it to edit
How the record reads
Add it to your DNS
- Type
- TXT
- Name
- @
- Value
- TTL
- 3600, or your provider's default
- Open your DNS provider and find any existing TXT record that starts with v=spf1. Edit it, because a domain can have only one SPF record.
- Paste the value without extra spaces or line breaks, then save.
- Wait a few minutes to a few hours, look the record up, and send a test email.
Common senders
Google, Microsoft 365, SendGrid, Mailchimp, Amazon SES and more.
Live lookup counter
See how close you are to the limit of 10 as you build.
Checks as you build
Warns about +all, long records and missing senders.
Private by design
Nothing is looked up or sent. It all runs in your browser.
Tick the services that send email for your domain, add your own server IP addresses, choose how strict the policy is, and copy the record. The lookup counter shows how close you are to the limit of 10, and the DNS panel shows where to paste it.
Key Takeaways
- An SPF record lists the servers allowed to send email for your domain, and receivers check it to spot fake mail.
- Use ~all while you test and move to -all only when every legitimate sender is on the list.
- SPF allows at most 10 DNS lookups, and lookups inside each include count too.
- A domain must have only one SPF record. Edit the existing TXT record instead of adding a second one.
- The generator only builds text. It does not check your live DNS, so publish the record and test it with a mail test.
How to Create an SPF Record
-
1STEP 1 List every service that sends email using your domain: your email host, newsletter tool, transactional email service, CRM, helpdesk and any servers of your own.
-
2STEP 2 Tick each sender in the generator. Add any missing service as a custom include, and add your own server IPs.
-
3STEP 3 Choose the policy. Use soft fail (~all) while testing and fail (-all) when you are sure the list is complete.
-
4STEP 4 Check the lookup counter. It must stay at 10 or fewer.
-
5STEP 5 Copy the record and publish it as a TXT record on your domain in your DNS settings, replacing any old SPF record.
What Is an SPF Record?
SPF stands for Sender Policy Framework. It is a TXT record in your domain DNS that lists the servers allowed to send email for your domain. When a message arrives, the receiving mail server checks the sending server against your list. If it is on the list, the message passes SPF. If it is not, the receiver can treat it as suspicious, send it to spam or reject it, depending on your policy.
SPF helps stop others from sending fake email that looks like it comes from you, and it helps your real email reach the inbox. Along with DKIM and DMARC, it is one of the three standard email authentication checks.
SPF Record Syntax Explained
An SPF record is one line of text. It starts with the version, then lists mechanisms, then ends with an all mechanism that says what to do with everything else. For example:
v=spf1 ip4:203.0.113.10 include:_spf.google.com ~all| Part | Meaning | Example |
|---|---|---|
| v=spf1 | Required. Marks the record as SPF version 1. Must be first | v=spf1 |
| ip4 and ip6 | Allows one IPv4 or IPv6 address or a range | ip4:203.0.113.10 or ip4:203.0.113.0/24 |
| include | Allows the servers listed in another domain SPF record | include:_spf.google.com |
| a | Allows the IP in your domain A record | a |
| mx | Allows the servers in your domain MX records | mx |
| exists | Passes if a DNS name exists. Rarely needed | exists:%{i}._spf.example.com |
| redirect | Uses another domain SPF record in full | redirect=_spf.example.com |
| all | Matches everything else. Always last | ~all |
The four qualifiers
| Symbol | Name | What receivers do |
|---|---|---|
| + | Pass (default) | Accept the mail. Rarely written out |
| - | Fail (hard fail) | The server is not allowed. Reject or treat as failed |
| ~ | Soft fail | Not allowed, but accept and mark as suspicious. Good for testing |
| ? | Neutral | No opinion either way |
Never end a record with +all. It allows every server in the world to send email as your domain, which makes SPF useless.
-all vs ~all: Which Should You Use?
Use ~all (soft fail) while you set up or while you are not sure the list is complete. Receivers will usually accept mail from servers that are not listed but may flag it. Move to -all (hard fail) once you have confirmed that every legitimate sender is included, because it gives the strongest protection. Many organisations also publish a DMARC policy, which decides what happens to mail that fails authentication. Check your reports before you tighten the policy.
The 10 DNS Lookup Limit
SPF allows at most 10 DNS lookups while a receiver evaluates a record. These mechanisms and modifiers count: include, a, mx, ptr, exists and redirect. The ip4, ip6 and all mechanisms do not count. Importantly, lookups inside an include count too, so one include can use several. If you go over 10, receivers return a permanent error, and your SPF check fails even if the sender was listed.
How to stay under the limit
- Remove services you no longer use, such as old newsletter or CRM tools.
- Prefer ip4 and ip6 for servers you control, since they cost no lookups.
- Avoid ptr. It is discouraged, slow and counts as a lookup.
- Use a separate subdomain for each sending service, such as news.example.com, each with its own short SPF record.
- If you must, replace an include with its IP ranges (called flattening), but remember that providers change their IPs, so flattened records need regular updates.
SPF also has a limit of two void lookups, which are lookups that return nothing. Remove includes that point to domains that no longer exist.
Example SPF Records
Google Workspace only
v=spf1 include:_spf.google.com ~allMicrosoft 365 only
v=spf1 include:spf.protection.outlook.com -allGoogle Workspace plus SendGrid plus your own server
v=spf1 ip4:203.0.113.10 include:_spf.google.com include:sendgrid.net ~allA domain that sends no email
v=spf1 -allThe last one is good for parked domains and old domains, because it tells receivers that no server may send mail for the domain. The addresses above come from a reserved documentation range, so replace them with your own.
Common SPF Include Values
Most email providers publish the include value to use. These are common examples. Always confirm with the provider current documentation, because values can change.
| Sender | Typical include |
|---|---|
| Google Workspace | include:_spf.google.com |
| Microsoft 365 | include:spf.protection.outlook.com |
| SendGrid | include:sendgrid.net |
| Mailchimp | include:servers.mcsv.net |
| Amazon SES | include:amazonses.com |
| Mailgun | include:mailgun.org |
| Zoho Mail | include:zoho.com |
How to Add an SPF Record to Your DNS
- 1Log in to the place where your domain DNS is managed. That is often your registrar, hosting company or a service such as Cloudflare.
- 2Open the DNS records page and look for an existing TXT record that starts with v=spf1. You must have only one SPF record per domain, so edit it, do not add a second.
- 3Create or edit a TXT record. Set the host or name to @ (or your domain, depending on the provider) and paste the generated record as the value.
- 4Save. Changes can take from a few minutes to some hours to spread.
- 5Check it. Look the record up with a DNS lookup tool, or in a terminal use nslookup with the TXT type, and send a test email to confirm that it passes.
Common SPF Problems and Fixes
- Two SPF records. Receivers return an error if there is more than one. Merge them into one record.
- Too many lookups. Count again and remove unused includes, as described above.
- Missing a sender. Mail from a service that is not listed will fail. Add its include value.
- Record too long. A single DNS string is limited to 255 characters, so long records are split into several strings by your DNS provider. If yours is very long, you probably need to simplify.
- Forwarded email fails. When mail is forwarded, the forwarding server is not in your SPF list. This is a known limit of SPF, which is why DKIM and DMARC matter.
- Typos. A missing space or a wrong colon makes the record invalid. Copy the generated record without changes.
SPF, DKIM and DMARC: How They Fit Together
SPF checks which servers may send for your domain. DKIM adds a digital signature to each message so receivers can check that it was not changed and that your domain approved it. DMARC ties them together, tells receivers what to do when checks fail, and sends you reports. Use all three for the best deliverability and protection.
Is My Data Private?
Yes. The record is built in your browser. Your domain, IP addresses and choices are not sent to a server or stored. The generator does not look up your live DNS, so it only creates text for you to review and publish yourself.
More Free Developer Tools
Tidy other technical data with the XML Formatter, SQL Formatter or HTML Minifier. Create IDs for your systems with the UUID Generator, or draft a professional email signature with the Email Signature Generator.
FAQs
What is an SPF record and why do I need one?
An SPF record is a DNS TXT record that lists the servers allowed to send email for your domain. Receiving servers check it to spot fake mail. Without one, your messages are more likely to go to spam, and others can more easily send email that pretends to be you.
How do I create an SPF record?
List every service that sends email for your domain, tick them in the generator, add any custom IPs, choose a policy such as ~all or -all, and copy the record. Then add it as a TXT record at the root of your domain in DNS. Keep to one SPF record per domain.
What is the difference between -all and ~all in SPF?
The all mechanism says what to do with servers not on your list. A -all means hard fail, so mail from other servers should be rejected. A ~all means soft fail, so mail is accepted but marked suspicious. Use ~all while testing and -all once all senders are included.
What is the SPF 10 lookup limit?
SPF allows at most 10 DNS lookups when a record is checked. Include, a, mx, ptr, exists and redirect count, including lookups inside the includes you add. Ip4, ip6 and all do not count. If you pass 10, the check returns an error, so keep your record short.
Can I have more than one SPF record?
No. A domain must have only one SPF record. If receivers find two or more, the check fails with an error. When you add a new sender, edit the existing record and add another include to it, and do not create a second TXT record that starts with v=spf1.
How do I add a new email service to my SPF record?
Find the include value in the provider documentation, such as include:sendgrid.net, and add it to your existing record before the all mechanism. Generate the updated record here to check the lookup count, then replace the old TXT record in your DNS. Send a test email to confirm it passes.
How long does an SPF record take to work?
The record is usually visible within minutes to a few hours, depending on your DNS provider and the TTL setting. Some receivers may keep an older copy until their cache expires. After you publish, look up the record and send a test email to see that it passes before you tighten the policy.
Does the generator check my live DNS or store my domain?
No. It builds the record from your choices in your browser and does not query your DNS or save anything. Publish the record yourself, then use a DNS lookup or a mail test to verify it. Nothing you enter, such as domains or IP addresses, is sent to a server.
Related Free Tools
XML Formatter
Format, validate and minify XML in your browser.
Open the toolSQL Formatter
Format and beautify SQL for common dialects.
Open the toolHTML Minifier
Shrink HTML, CSS and JS inside a page.
Open the toolUUID Generator
Create v4 and v7 UUIDs in bulk.
Open the toolReady to build your SPF record?
Go back to the generator, tick your senders and copy the record.
Use the tool