SPF Generator
Create an SPF record by adding the services and servers that send mail for your domain. Choose a failure policy, optionally redirect to another domain's record, and copy the DNS value.
Valid, with warnings
Your SPF record
Host / name: @ · Type: TXT
v=spf1 include:_spf.google.com ~all
DNS lookups used by this record: 1 of 10. Includes you add may use more of their own, so check the full chain with the SPF Validator.
- ~all is a good starting point. Once every sending service is listed and tested, consider moving to -all.
Publish one SPF record per domain. If the domain already has one, edit it instead of adding a second, because two records cause a permanent error.
What is SPF Generator?
An SPF record is a DNS TXT record that lists which servers may send email for your domain. This generator lets you add include, IPv4, IPv6, A record, MX record and exists entries, choose a failure policy, and optionally redirect to another domain's SPF record. It counts the DNS lookups the record uses against the limit of 10 and warns about problems such as an unsafe +all policy. A domain should publish only one SPF record, so merge new senders into your existing record instead of adding a second. Test the result with the SPF Validator before you rely on it.
Why use this tool?
- Add include, IPv4, IPv6, A record, MX record and exists entries, and add or remove as many values of each as you need.
- Turn on a redirect to reuse another domain's SPF record. It is off by default.
- Choose a failure policy: fail (-all), soft fail (~all), neutral (?all) or pass (+all).
- A counter shows how many of the 10 allowed DNS lookups the record uses, and warnings flag unsafe or invalid entries.
How to use SPF Generator
- Step 1. Optionally enter your domain, so the DNS instructions show the right host name.
- Step 2. Use the quick-add buttons or the Include list to add the services that send your mail, such as Google Workspace or SendGrid.
- Step 3. Add any fixed servers under IPv4 and IPv6, and use the A record and MX record sections for hosts you manage.
- Step 4. Choose a failure policy. Start with soft fail (~all) and move to fail (-all) when every sender is listed and tested.
- Step 5. Copy the record and publish it as a TXT record on your domain, then check it with the SPF Validator.
Common use cases
Important notes
- A domain must publish only one SPF record. If you already have one, merge the new entries into it instead of publishing a second record.
- SPF allows at most 10 DNS lookups. Each include, a, mx, exists and redirect counts, and an included record's own lookups count as well.
- With a redirect on, the record has no all term. A redirect applies only to senders that none of the other entries match, and it is ignored if the record also ends in all.
- In the A record and MX record sections, the switch adds your own domain's records. For another host, enter its name, and add /24 after it for an address range.
- Quick-add values are the includes the services publish at the time of writing. Confirm them in your provider's documentation.
- SPF alone does not stop spoofing of the visible From address. Pair it with DKIM and a DMARC policy.
More DNS & Website Tools
SPF Generator FAQ
What does include do in an SPF record?
It authorizes every server listed in another domain's SPF record. Email providers publish a record for you to include, such as _spf.google.com.
What is the SPF 10 lookup limit?
Receivers stop after 10 DNS lookups caused by include, a, mx, exists and redirect, and treat more as a permanent error. The generator counts them for you.
Should I use -all or ~all?
Use ~all while you check that every sender is listed, then move to -all for stricter handling. Avoid +all, which allows any server.
When should I use a redirect?
Use it when a domain or subdomain should follow another domain's SPF record exactly. It replaces the all term. If you need to add your own entries and a policy, use include instead.
Can a domain have two SPF records?
No. Two records cause a permanent error, and receivers may ignore SPF. Merge them into one record.
What does the exists mechanism do?
It passes when a DNS name you give resolves. It supports macros such as %{i} for the sender's IP address and is mainly used in advanced setups.