SPF Record Generator
Build a valid SPF record for your domain. Select your email providers, add custom rules, and copy the DNS record.
SPF Record Syntax Explained
An SPF record is a single DNS TXT record on your root domain. A typical record generated by this tool looks like:
v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.5 ~all| Mechanism | What it does | Counts toward 10-lookup limit? |
|---|---|---|
| v=spf1 | Version tag — must be first, exactly once | — |
| include: | Authorizes another domain's SPF record (your email providers) | Yes |
| ip4: / ip6: | Authorizes a specific IP address or CIDR range | No |
| a / mx | Authorizes your domain's A or MX hosts | Yes |
| redirect= | Delegates evaluation entirely to another domain's record | Yes |
| ~all | Softfail: unauthorized mail is marked suspicious but delivered | No |
| -all | Hardfail: unauthorized mail should be rejected | No |
Common SPF Errors and How to Fix Them
Too many DNS lookups (PermError)
More than 10 DNS-querying mechanisms breaks SPF for the whole domain. Remove providers you no longer use, or replace include: entries with ip4: addresses where the provider publishes stable IPs. Our SPF checker counts your lookups.
Multiple SPF records
A domain must publish exactly one v=spf1 record. Two or more cause a permanent error. Merge them into a single record listing all senders.
Using +all
+all authorizes the entire internet to send as your domain, which defeats the purpose of SPF. End your record with ~all or -all.
Forgetting a sending service
If a legitimate provider isn't listed, its mail softfails or bounces. Audit everything that sends as your domain — email hosting, marketing, transactional, support desk — and include each one.
SPF alone isn't enough
SPF checks the hidden envelope sender, not the visible From address, so it can't stop From-spoofing by itself. Pair it with DKIM and a DMARC record for real protection.
SPF Generator FAQs
What is an SPF record?
SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are authorized to send email for your domain. Receiving servers check SPF to verify the sender is legitimate and reject forged messages.
How do I know which providers to include?
Include every service that sends email as your domain: your email hosting (Google Workspace, Microsoft 365), marketing platforms (Mailchimp, HubSpot), transactional services (SendGrid, Amazon SES), and support tools (Zendesk, Freshdesk). Use the "Check Existing SPF" button to import your current configuration.
What's the difference between ~all and -all?
~all (softfail) marks unauthorized emails as suspicious but still delivers them — good for new setups while you confirm all senders. -all (hardfail) tells receivers to reject unauthorized emails — use this once you're confident your record is complete.
What is the 10 DNS lookup limit?
RFC 7208 limits SPF evaluation to 10 DNS-querying mechanisms (include, a, mx, redirect, etc.). Exceeding this causes a permanent error (PermError) and SPF stops working. ip4 and ip6 mechanisms don't count toward this limit.
What is redirect= in SPF?
The redirect= modifier delegates your domain's entire SPF evaluation to another domain's record. Unlike include:, which adds authorized senders alongside your own, redirect= replaces everything. It's used by subsidiary domains or domains fully managed by another organization. When redirect= is present, no all mechanism is needed.
Do I still need DMARC after setting up SPF?
Yes. SPF alone doesn't prevent spoofing of the visible "From" address. DMARC ties SPF and DKIM together and tells receivers what to do when authentication fails. Use our DMARC Generator to create your DMARC record next.
Related Tools
SPF Checker
Validate your SPF record after deploying to DNS.
DMARC Generator
Create a DMARC record to complete your email authentication.
DMARC Checker
Validate your DMARC record and security posture.
DKIM Checker
Look up and validate DKIM records for any domain.
Bulk DMARC & SPF Lookup
Validate records for up to 50 domains at once.
DMARC Analyzer
Upload and parse DMARC XML aggregate reports.