Build the SPF TXT record that authorises your mail senders, or paste an existing record to validate syntax and count DNS lookups against the limit of 10.
SPF Record Generator
Build the SPF TXT record that authorises your mail senders, or paste an existing record to validate syntax and count DNS lookups against the limit of 10.
The SPF Record Generator runs entirely in your browser. Records are built and checked on your device — no DNS queries are made and nothing is uploaded.
SPF Record Generator builds the one TXT record that tells receiving mail servers who may send email as your domain. Tick the providers you send through — Google Workspace, Microsoft 365, SendGrid and friends map to their documented include mechanisms — add any servers of your own by IP, and choose what happens to everyone else: ~all softfail while you are still discovering senders, -all reject once the list is complete. The checker side parses any existing record the way a receiver would: it verifies the v=spf1 prefix, flags the deprecated ptr and the catastrophic +all, warns about terms after all that receivers ignore, and counts DNS-querying mechanisms against the hard limit of 10 that silently breaks so many records.
Features
One-click includes for the major mail providers
ip4 and ip6 mechanisms with address and CIDR validation
a and mx toggles for domains that send from their own hosts
All four all-policies explained honestly, +all included
Checker parses any record and lists issues by severity
DNS lookup counter against the RFC 7208 limit of 10
Warns on deprecated ptr and unreachable terms after all
Everything validated in your browser — nothing queried remotely
How to use the SPF Record Generator
Pick the providers that send mail for your domain
Add your own server IPs if any, and set the all policy
Copy the record into a TXT record on your root domain
Or switch to Check mode and paste an existing record to audit it
Two DNS lookups of the allowed ten — plenty of headroom.
Common errors & troubleshooting
Mail fails SPF even though the record looks right. — Count the lookups. include, a, mx, ptr, exists and redirect each cost one, and nested includes count too — past ten, receivers return permerror and treat the record as broken. Flatten rarely-used includes into ip4 mechanisms.
The domain has two SPF records. — That is an automatic permanent error — receivers must reject the setup. Merge all mechanisms into a single v=spf1 string; there is only ever one SPF record per domain.
A provider was added but its sends still softfail. — DNS caches the old record until the TTL expires, often an hour. Verify the live record with a DNS lookup tool and wait out the TTL before concluding the record is wrong.
Everything passes — including spoofed mail. — Check for +all, which authorises the entire internet and is worse than no record. Use -all, or ~all during rollout, and pair with DMARC so failures become policy.
Frequently asked questions
What is an SPF record and why does my domain need one?
It is a DNS TXT record listing the servers allowed to send email claiming to be your domain. Receivers check the connecting server against it; without SPF, spammers can forge your address freely and your legitimate mail inherits the reputation damage.
Should I end my SPF record with ~all or -all?
Start with ~all — failures are marked but delivered, so a forgotten sender does not lose mail while you complete the list. Move to -all once reports show every legitimate source passing; that is the setting that actually blocks spoofing.
What is the SPF 10 DNS lookup limit?
RFC 7208 caps the DNS-querying mechanisms — include, a, mx, ptr, exists, redirect — at ten per evaluation, counted recursively through nested includes. Exceeding it returns permerror, which many receivers score like a failure. Each provider include typically costs one to three.
Does SPF alone stop email spoofing?
No. SPF checks the envelope sender, not the From header the user sees, and it breaks on plain forwarding. Pair it with DKIM signatures and a DMARC policy — the three together are what receivers treat as real authentication.
Where do I publish the SPF record?
As a TXT record on the bare domain (often written @ in DNS panels), value starting v=spf1. Subdomains that send mail need their own records, and domains that never send should publish v=spf1 -all to shut spoofers out.
Related tools
DMARC Record Generator — Build and validate a DMARC DNS TXT record with policy, reporting and alignment.