SPF record generator
This SPF record generator builds one valid v=spf1 TXT record for every service that sends email as your domain. Tick your providers, add any other includes or IP addresses, and copy the result. It counts DNS lookups as you go and warns about the mistakes that break SPF.
What does an SPF record contain?
An SPF record is one TXT record at the root of your domain that starts with v=spf1, lists who may send mail for you, and ends with an all term. Senders are listed with include: for a provider's own record, ip4: or ip6: for fixed addresses, and a or mx for your own servers. (RFC 7208)
Can a domain have more than one SPF record?
No. A domain must publish exactly one SPF record. If receivers find two TXT records that start with v=spf1, SPF returns a permanent error and does not pass. When you add a new sending tool, merge its include into the record you already have instead of adding a second one. (RFC 7208, section 4.5)
How many includes can SPF have?
Up to 10 DNS lookups in total, and that count covers includes nested inside the records you include, not just the ones you can see. Each include, a, mx, ptr, exists and redirect counts. This generator counts your top-level lookups; the checker follows every nested one. (RFC 7208, section 4.6.4)
Google's own _spf.google.com record includes further records, so even a simple record uses several lookups once nested ones are counted.
Should SPF end in ~all or -all?
Either works. Google recommends ~all, a soft fail that marks unlisted senders as suspicious. Microsoft recommends -all, a hard fail, once DKIM and DMARC are also in place, and notes that DMARC treats both endings as an SPF failure. Never use +all, which lets any server on the internet send as you. (Google, Microsoft)
Which include do my sending tools need?
Use the value in each tool's own setup docs, and check where it belongs first. Some tools send with their own bounce domain, so SPF is checked there instead of at your root. Amazon SES, for example, puts include:amazonses.com on a custom MAIL FROM subdomain, not your root, and SendGrid's automated security manages SPF through CNAME records. (AWS, SendGrid)
| Provider | Include value |
|---|---|
| Google Workspace | include:_spf.google.com (Google) |
| Microsoft 365 | include:spf.protection.outlook.com (Microsoft) |
| Zoho Mail | include:zoho.com (Zoho) |
| Namecheap Private Email | include:spf.privateemail.com (Namecheap) |
What comes after SPF?
SPF alone does not stop someone from spoofing your From: address. Turn on DKIM signing in every service that sends for you, then publish DMARC so receivers know what to do with mail that fails. The DMARC record generator builds that record, and the setup guide covers all three in order.
Frequently asked questions
Where do I add the SPF record?
At your DNS host, as a TXT record on the root of the domain, usually shown as @ or left blank. If your registrar and DNS host are different companies, add it where your nameservers point.
How long does an SPF change take to work?
Usually minutes to a few hours, depending on the TTL of the old record. Run the checker after publishing to confirm receivers can see the new record.
Does a domain that never sends email need SPF?
Yes. Publish v=spf1 -all so nobody can send mail that passes SPF as that domain, and pair it with a DMARC policy of p=reject.
Does this generator store my domain?
No. The record is built in your browser and nothing is sent anywhere. The checker link only runs when you click it.