SPF Record Generator
Build a valid SPF record for your domain. Select your email providers, add custom rules, and copy the DNS record. The lookup count includes every include nested inside your providers' records.
SPF Record Syntax and Examples
An SPF record is a single DNS TXT record on your root domain. A typical record generated by this tool looks like:
| Mechanism | What it does | Counts toward 10-lookup limit? |
|---|---|---|
| v=spf1 | Version tag. Must come first, exactly once | No |
| include: | Authorizes another domain's SPF record (your email providers) | Yes |
| ip4: / ip6: | Authorizes a specific IP address or CIDR range | No |
| a / mx | Authorizes your domain's A or MX hosts | Yes |
| redirect= | Delegates evaluation entirely to another domain's record | Yes |
| ~all | Softfail: unauthorized mail is marked suspicious but delivered | No |
| -all | Hardfail: unauthorized mail should be rejected | No |
SPF record examples you can copy
Google Workspace only
Google's recommended record for domains that send only through Gmail.
Microsoft 365 only
Microsoft's recommended record; Microsoft advises -all when DKIM and DMARC are also configured.
Google Workspace plus SendGrid
Add each additional sender's include to the same record. Check your provider's documentation for its exact include.
Your own mail server plus Microsoft 365
ip4 and ip6 entries authorize specific addresses and don't count toward the 10-lookup limit.
A domain that never sends email
Tells receivers no server is authorized. Pair it with a DMARC record of v=DMARC1; p=reject;.
Publish the record as a single TXT record on your root domain (host @), then confirm it with the SPF checker. Provider-specific steps are in the Google Workspace and Microsoft 365 setup guides.
Common SPF Errors and How to Fix Them
Too many DNS lookups (PermError)
More than 10 DNS-querying mechanisms breaks SPF for the whole domain. Remove providers you no longer use, or replace include: entries with ip4: addresses where the provider publishes stable IPs. Our SPF checker counts your lookups.
Multiple SPF records
A domain must publish exactly one v=spf1 record. Two or more cause a permanent error. Merge them into a single record listing all senders.
Using +all
+all authorizes the entire internet to send as your domain, which defeats the purpose of SPF. End your record with ~all or -all.
Forgetting a sending service
If a legitimate provider isn't listed, its mail softfails or bounces. Audit everything that sends as your domain (email hosting, marketing, transactional, support desk) and include each one.
SPF alone isn't enough
SPF checks the hidden envelope sender, not the visible From address, so it can't stop From-spoofing by itself. Pair it with DKIM and a DMARC record for real protection.
SPF Record Generator FAQs
What is an SPF record?
SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are authorized to send email for your domain. Receiving servers check SPF to verify the sender is legitimate and reject or flag forged messages.
How do I know which providers to include?
Include every service that sends email as your domain: your email hosting (Google Workspace, Microsoft 365), marketing platforms (Mailchimp, HubSpot), transactional services (SendGrid, Amazon SES), and support tools (Zendesk, Freshdesk). Use the Check Existing SPF button to import your current configuration.
What's the difference between ~all and -all?
~all (softfail) marks unauthorized emails as suspicious but still delivers them, which suits new setups while you confirm all senders. -all (hardfail) tells receivers to reject unauthorized emails; use it once you're confident your record is complete.
What is the 10 DNS lookup limit?
RFC 7208 limits SPF evaluation to 10 DNS-querying mechanisms and modifiers (include, a, mx, ptr, exists and redirect), including those inside nested includes. Exceeding the limit causes a permanent error (PermError) and SPF stops working. ip4 and ip6 mechanisms don't count toward the limit.
What is redirect= in SPF?
The redirect= modifier delegates your domain's entire SPF evaluation to another domain's record. Unlike include:, which adds authorized senders alongside your own, redirect= replaces everything. It's used by subsidiary domains or domains fully managed by another organization. When redirect= is present, no all mechanism is needed.
Do I still need DMARC after setting up SPF?
Yes. SPF alone doesn't prevent spoofing of the visible From address. DMARC ties SPF and DKIM together and tells receivers what to do when authentication fails, so create a DMARC record next.
Next step: generate a DMARC record with the DMARC record generator.
Related tools
- SPF checkerValidate your SPF record after deploying to DNS.
- Create DMARC recordBuild a DMARC record with a live preview to complete your email authentication.
- DMARC checkerValidate your DMARC record and security posture.
- DKIM checkerLook up DKIM keys, with or without a selector.
- Bulk DMARC & SPF lookupValidate records for up to 50 domains at once.
- DMARC report analyzerUpload and parse DMARC XML aggregate reports.