SPF Record Generator

Build a valid SPF TXT record by ticking the email providers you use. Counts DNS lookups so you stay within the RFC 7208 limit of 10.

What this tool checks

• Pre-built includes for Google Workspace, Microsoft 365, Mailgun, SendGrid, Mailchimp, Postmark, Amazon SES, Zoho, Resend
• Custom IPv4 and IPv6 ranges
• Optional `a` and `mx` mechanisms
• Live DNS lookup counter against the RFC 7208 limit of 10
• Strictness terminator (-all, ~all, ?all) with explanations
• Free-form additional includes for niche senders

Why it matters

Without SPF, anyone can forge mail from your domain — phishing campaigns, spoofed invoices, fake password resets, the lot. Gmail, Outlook, and Yahoo now silently drop a growing share of unauthenticated mail. A correct SPF record is the cheapest deliverability fix available and the foundation DMARC sits on.

How to fix what it finds

• List every service that sends mail from your domain (transactional, marketing, helpdesk, ATS, ESP)
• Tick each one in the generator — the include strings are pre-filled
• Add any custom IP ranges your servers send from directly
• Start with `~all` (soft-fail) while you check reports, then promote to `-all`
• Publish as a TXT record on the apex of your domain (Name: @, Type: TXT, Value: the generated string)
• Wait 24 hours, then verify with a DMARC report or our deliverability checker

Methodology

A deterministic client-side builder following RFC 7208 (the SPF specification). Each provider tick adds an `include:` mechanism using that provider's officially documented SPF host — pulled from each vendor's setup docs as of June 2026 and reviewed quarterly. We count DNS lookups in real time: `include`, `a`, `mx`, `ptr`, and `exists` each consume one of your ten allowed lookups; `ip4` and `ip6` do not. The lookup counter warns you above 8 and errors above 10. The strictness terminator (`-all`, `~all`, `?all`) sits at the end of the record per spec, and the entire record is rendered as a single space-separated string ready to paste into your DNS provider as a TXT value on the apex.

Frequently asked questions

What is SPF?

Sender Policy Framework — a DNS TXT record listing the servers and providers allowed to send mail from your domain. Receiving mail servers check it on every inbound message; mail from anything not on the list is flagged or rejected.

Why does SPF have a 10-lookup limit?

Each `include:` or `a:` mechanism triggers another DNS query. To prevent SPF being weaponised for DoS amplification, RFC 7208 caps total lookups at 10. Beyond that, receivers MUST return a permerror — meaning your mail fails auth regardless of how clean the rest of your setup is.

What is the difference between -all, ~all, and ?all?

-all = hard fail (reject), ~all = soft fail (mark as spam), ?all = neutral (no opinion). Start with ~all while you collect DMARC reports, then promote to -all once you are certain all legitimate senders are listed.

Do I need both SPF and DMARC?

Yes. SPF authenticates the sending server; DMARC tells receivers what to do when authentication fails AND aligns the From: header with the authenticated domain. Without DMARC, SPF alone does not prevent display-name spoofing.

Can I have more than one SPF record?

No — only one SPF record per domain. Multiple SPF TXT records on the same name is a hard fail (permerror) at every receiver. Merge them into a single record with all includes inside.

I exceeded 10 lookups. What now?

Either remove an include you don't use, or use SPF flattening (a service that resolves your includes to raw IPs and rewrites the record dynamically). Most ESPs offer a flattening service; we recommend doing it via a dedicated tool that auto-updates as your providers change IPs.