Free tool
SPF record generator
Pick the services that send email for your domain and copy a ready SPF record, checked against the limit of 10 DNS lookups.
The rules
- SPF records
- 1 per domain
- DNS lookups
- 10 at most
12 providers to pick from, plus your own IPs and includes.
Who sends email for your domain?
1 pickedProviders sometimes change their include. If one has its own setup page, use what it shows there.
Your own servers and other services
How it works
From your senders to one TXT record
SPF tells receivers which servers may send email as your domain.
- 01
Pick your senders
Tick your mailbox provider and every service that sends as your domain: newsletters, transactional email, your CRM. Add IP addresses or other includes if you have them.
- 02
Choose the all rule
~all (soft fail) marks mail from anywhere else but still accepts it, a safe start. -all rejects it, once you are sure every sender is listed.
- 03
Count the lookups
Each include, a and mx costs one DNS lookup, and includes can hold more. Count every lookup follows them live, so you see the real total before you publish.
- 04
Publish it
Add the record as a TXT record on the root of your domain (@) at your DNS host, replacing any SPF record already there.
FAQ
Questions, answered
Short answers about the spf record generator.
What is the SPF 10 lookup limit?
Receivers stop after 10 DNS lookups while checking SPF (RFC 7208). Each include, a, mx, ptr, exists and redirect costs one, including the ones inside the includes. Over 10, SPF returns a permanent error and counts as a fail.
Can I have two SPF records?
No. A domain must have exactly one SPF record. With two, SPF fails for every message. Merge everything into one record, which is what this generator builds.
Should I use ~all or -all?
Start with ~all while you confirm every service that sends for you passes. Once DMARC reports show nothing legitimate failing, -all is the stricter choice. Avoid ?all and +all.
Is SPF enough for cold email?
No. Set up DKIM signing with your mailbox provider and a DMARC record as well. Gmail and Yahoo expect all three from bulk senders, and the domain email checker shows what you have.