Skip to main content
WebTools

SPF record generator

Build one SPF record for your domain from the services that send your email. We check it the way receivers do, including the limit of 10 DNS lookups.

Email providers

Tick each service that sends email from this domain. We add the include its own help pages give.

This domain's own servers

Only tick these if those servers really send email. Each one adds a DNS lookup.

Up to 10, one per line, such as 203.0.113.5, 198.51.100.0/24 or 2001:db8::/48. These need no DNS lookups.

Up to 5 domain names a provider asked you to include, one per line, such as spf.example.net. Each adds at least one DNS lookup.

What receivers should do with mail from servers not listed.

Choosing a check opens its page. With the keyboard, use the arrow keys, then press Enter.

How to use this generator

Enter your domain, tick the services that send email for it, and add any of your own servers. We build one SPF record and check it the way receiving mail servers do, including the limit of 10 DNS lookups. Then add the record to your DNS as a TXT record at the domain itself.

A domain must have only one SPF record. If it already has one, we show it: replace it with the new record rather than adding a second, because two SPF records make SPF fail for every message.

What goes in the record

A domain that sends no email

If you tick nothing and list nothing, the record is v=spf1 -all. That tells receivers the domain never sends email, which stops others sending as it. It is a good idea for parked domains.

Frequently asked questions

Where do I put the SPF record?

Add it as a TXT record at the domain itself (often shown as @ or left blank in your DNS panel). A domain must have only one SPF record: if it already has one, replace it with the new record rather than adding a second.

Should I use ~all or -all?

Both tell receivers that other servers aren't allowed. ~all (soft fail) asks them to treat such mail as suspicious, and is the usual choice while you check everything works, or when DMARC decides what happens. -all (fail) asks them to reject it. Use -all once you are sure every service that sends your mail is listed.

What is the 10 lookup limit?

Receivers stop after 10 DNS lookups while checking SPF, counting every include, a, mx, exists and redirect, including those inside each include. Over 10, SPF fails for every message (RFC 7208 §4.6.4). We count them live, so you see the real number before you publish.

My provider isn't listed. What do I add?

Your provider's help pages give the include to use, such as include:spf.example.net. Enter the part after include: under Other includes, or list your servers' IP addresses under Other sending servers.

Is what I enter saved?

No. The record is built and checked when you press Generate, then shown to you. It isn't cached, saved, logged or shown in recent checks.

Guides about this tool

More email guides

Related tools

  • SPF Checker

    Check that a domain's SPF record is valid, stays within the 10-lookup limit, and says what you expect about servers that may send its mail.

  • DMARC Record Generator

    Build a DMARC record for your domain: choose what receivers should do with mail that fails, and where to send reports. We check it before you publish.

  • MTA-STS Checker

    Check whether a domain asks other mail servers to use secure, verified connections when they deliver its email.

  • DMARC Checker

    Find the DMARC policy that applies to a domain, see what each setting means, and spot mistakes that make receivers ignore it.