SPF Record Generator

Choose the services that send email for your domain, add any extra IPs, and pick a policy. We build a valid v=spf1 record and count DNS lookups against the limit of 10 as you go.

Email providers

Your own servers

Policy for everyone else

Your SPF record

v=spf1 ~all
0 of 10 DNS lookups

How to publish

Add a TXT record at your domain's root (@) with the value above. Keep only one SPF record per domain. After it propagates, confirm it with the SPF checker and see the whole picture in the deliverability report.

How an SPF record works

SPF (Sender Policy Framework) is a single TXT record that lists every server allowed to send email for your domain. When a receiver gets a message, it checks the sending IP against your record and applies the final all policy to anything that does not match. A correct SPF record stops attackers from sending mail as your domain and helps your own mail reach the inbox.

Each include, a, mx, ptr and exists term costs one DNS lookup, and the standard (RFC 7208) caps evaluation at ten. This generator counts them for you so you do not accidentally break authentication - if you go over, remove providers you no longer use or flatten includes to IPs.

Examples

  • v=spf1 include:_spf.google.com -all - Google Workspace only.
  • v=spf1 a mx include:spf.protection.outlook.com ~all - own servers plus Microsoft 365.

FAQ

Should I end with -all or ~all?
Start with ~all (soft fail) while you confirm every legitimate sender is listed, then tighten to -all (hard fail) for real protection.
Can I have two SPF records?
No. A domain must publish exactly one v=spf1 record. Two records cause a PermError and SPF fails.
What is the 10-lookup limit?
SPF evaluation may perform at most ten DNS-querying terms, counted through every include. Past that, receivers return PermError. This tool warns you before you cross it.
Where do I put the record?
As a TXT record on the root domain. It is not a separate record type - SPF lives in a TXT record.