SPF Record Generator
This free SPF record generator builds the TXT record that lists every service allowed to send email for your domain, and estimates how many of the 10 allowed DNS lookups it uses.
We never offer +all, which would let any server on the internet send as you. The record is built in your browser and nothing is sent to us.
What is an SPF record?
An SPF record is a TXT record on your domain that lists the servers allowed to send email for it. Receiving servers check it to spot forged senders (RFC 7208).
It starts with v=spf1, lists senders with mechanisms like include, ip4 and mx, and ends with an all rule that says what to do with mail from anywhere else.
How to build yours
Tick every service that sends mail as your domain: your mailbox provider, your newsletter tool, your shop or CRM. Forgetting one is the most common reason legitimate mail lands in spam after SPF goes live.
Add a and mx only if your web server or your incoming mail servers also send mail. Everything is put together in your browser, so nothing you enter is sent to us.
The 10-lookup limit
SPF allows at most 10 DNS lookups per check. Every include, a and mx costs one, and the includes inside your providers' records count too, which is why our number says at least.
Go over 10 and receivers treat the whole record as broken. Once it's live, run our SPF checker: it follows every nested include and gives you the real total.
~all or -all?
~all (soft fail) marks mail from unlisted servers as suspicious without refusing it outright. It's the safe choice while you're still discovering everything that sends for you.
-all (hard fail) asks receivers to reject that mail. Switch once you're confident the list is complete and DMARC reports agree. We never offer +all, because it lets anyone send as you.
Frequently asked questions
Can I have two SPF records?
No. A domain must publish exactly one v=spf1 record. Two records are an error and receivers ignore both, so merge everything into one, which is what this generator does.
Where do I add the SPF record?
As a TXT record on the domain itself. In most DNS panels the host is @ or left empty. If you already have a v=spf1 record, replace it rather than adding a second one.
Why does my provider's include count as more than one lookup?
Because its record often contains includes of its own. Microsoft 365 and Google Workspace each add more lookups behind the scenes, so check the live record with the SPF checker.
Do I need to list my newsletter tool?
Usually, yes, if it sends with your domain in the envelope sender. Some tools use their own bounce domain and authenticate with DKIM instead. Their setup guide will say which applies.
Is SPF enough to stop spoofing?
No. SPF checks the hidden envelope sender, not the From address people see. Add DKIM and a DMARC record on top; our DMARC record generator helps with the last step.