SPF Generator

⚙ DNS & authentication

Select the services that send mail for your domain and get a valid SPF record — with a live count against the 10-lookup limit.

No sign-up required Runs on our own infrastructure Also available via API
Which services send email for this domain?
Your SPF record
Host/name: yourdomain.com (root TXT — use “@”)
Type: TXT
Value: v=spf1 ~all

Uses about 0 of the 10 allowed DNS lookups. Publish exactly one SPF record per domain.

SPF is the oldest of the three email-authentication standards, and for all its age it still does one job well: it tells receivers which servers are allowed to put mail into the envelope for your domain. Anything sent from an IP that isn’t on the list gets treated as suspect. The record itself is a single line of text, but the syntax is fussy and the failure modes are quiet — a stray extra include or a second SPF record can knock your whole domain out of authentication without a single error message. This generator builds a clean record from the services you actually use, and it watches the one limit that catches almost everyone.

What an SPF record is made of

An SPF record is a TXT record that starts with v=spf1 and lists mechanisms — the ways a receiver can decide an IP is authorised — followed by an all mechanism that catches everything else. The common ones:

  • ip4: / ip6: — a specific address or CIDR range you send from. These cost zero DNS lookups, which makes them the cheapest way to authorise a fixed IP.
  • a / mx — authorise the domain’s own A record or the hosts in its MX record. Handy if your mail server is also your web server.
  • include: — pull in another domain’s SPF record, e.g. include:_spf.google.com. This is how you delegate to Google, Microsoft 365, SendGrid, SES and the rest. Each one costs a DNS lookup.
  • redirect= — hand off the whole SPF decision to another domain. Used when many domains share one policy; it replaces (not supplements) your all.

Qualifiers, and why -all vs ~all matters

Every mechanism carries a qualifier that says what to do on a match: + pass (the default, so it’s usually omitted), - fail, ~ softfail, and ? neutral. The one that actually matters is the qualifier on the final all:

  • -all (hard fail) — “anything not listed above is not us; reject it.” This is the goal, and it’s what makes DMARC enforcement meaningful.
  • ~all (soft fail) — “probably not us, but accept and mark it.” A sensible place to sit while you’re still discovering senders, but don’t treat it as a permanent home.
  • ?all (neutral) — says nothing useful; effectively no protection. Avoid it.

The full mechanism and qualifier grammar is defined in RFC 7208.

The 10-lookup limit — the thing that breaks records

SPF caps the number of DNS lookups a receiver has to perform at 10. Every include, a, mx, ptr and redirect counts against it, and includes nest — a single provider’s include can quietly pull in three or four more. Exceed 10 and the receiver returns permerror, at which point SPF is treated as failing entirely, even for legitimate mail. This generator counts your lookups live so you can see the budget as you add services. If you’re already over, expand the record with the SPF Include Tree to find the heavy branch, and lean on ip4:/ip6: ranges where a provider publishes stable IPs.

Publishing it correctly

  1. Publish exactly one SPF record. A domain must have a single v=spf1 TXT record. Two records is a configuration error and most receivers will permerror on it — merge them into one.
  2. Put it at the root domain as a TXT record (not a legacy SPF-type record, which is deprecated).
  3. Include every real sender — your mailbox provider, your marketing platform, your helpdesk, your invoicing tool. A sender you forget is a stream that silently fails authentication.
  4. Verify after publishing with the SPF Checker, and once SPF and DKIM are solid, tie them together with a DMARC record.

Frequently asked questions

Can I have two SPF records on one domain?
No — exactly one v=spf1 TXT record per domain. Two records is a permerror. Merge every provider into one record with multiple include: mechanisms.
Should I end my SPF record with -all or ~all?
Aim for -all once every sender is listed — it’s what makes DMARC enforcement bite. Sit at ~all only while you’re still finding senders. Skip ?all.
What is the SPF 10-lookup limit?
SPF allows at most 10 DNS lookups; include, a, mx and redirect all count and includes nest. Over 10 returns permerror. Trace it with the Include Tree.
Do I still need SPF if I have DKIM and DMARC?
Yes — DMARC needs either SPF or DKIM to pass and align, so having both is more robust. SPF also covers the envelope path DKIM doesn’t.