SPF Record Generator
Runs in your browser — your data is never uploaded.
Build the TXT record that says which servers may send mail as your domain. The syntax is a single line and easy; what is not easy is the limit hiding inside it. SPF permits ten DNS-resolving mechanisms, and every include: counts — so adding one provider too many turns the record into a permanent error and can fail all of your mail at once. This counts them as you build.
How to use SPF Record Generator
- 1
Add the include: values your providers publish — Google Workspace, Microsoft 365, your ESP.
- 2
Add any fixed sending IPs, and tick a or mx if your own server sends mail.
- 3
Choose the policy, click “Generate”, and publish the result as a TXT record on the domain itself.
Share
Embed this tool on your site
Paste this where you want the tool to appear. It runs entirely in your visitor's browser — no uploads, no account, no tracking.
Please keep the attribution line — it's what keeps these tools free.
Need a different size, a dark theme, or a different tool? Build an embed lets you preview it first.
Frequently asked questions
What is the 10 DNS lookup limit?+
SPF allows at most ten mechanisms that require a DNS query — include, a, mx, ptr and exists. Go over and receivers must return permerror, which many treat as an outright failure. The count is recursive, too: one include: can contain several of its own, so a record with eight visible lookups can already be over. Validate the published record, not just this line.
Should I end with -all or ~all?+
-all is a hard fail: unlisted senders should be rejected. ~all is a soft fail: accept but mark as suspicious. Start on ~all while you confirm nothing legitimate is missing, then move to -all. ?all is neutral and does nothing at all — it is identical in effect to having no SPF record.
Can I have two SPF records?+
No. A domain must publish exactly one TXT record starting v=spf1. Two is a permanent error for the whole domain, and it is the standard outcome of adding a second provider by adding a second record instead of another include: to the existing one.
Does SPF stop people spoofing my domain?+
Only partly. SPF authenticates the envelope sender, which the recipient never sees. Someone can pass SPF on a domain of their own while putting your name and address in the visible From: header. Closing that gap is what DMARC is for, and DMARC needs SPF or DKIM underneath it.
Where does the record go?+
On the domain itself — a TXT record with the name @ or blank, depending on your DNS provider. Not on a subdomain, and not at _spf unless you are publishing a separate include target. Subdomains that send mail need their own record.