Free tool · no sign-up

Free SPF record generator

Tick the services that send e-mail as your domain, add your own servers and get a single, valid SPF record ready to paste into your DNS. The generator counts DNS lookups as you go, so you stay under the limit of 10 that silently breaks SPF.

Runs 100% in your browser — nothing is uploaded

Used for the host name and to verify the record after publishing.

Services that send as your domain

The number is the estimated DNS lookups each one uses, including nested includes.

Not listed? HubSpot gives you an account-specific include under Settings › Domains & URLs; Mailchimp needs no SPF include (it authenticates your domain with DKIM). Add other includes below, exactly as your provider documents them.

Your own servers

Separate with commas, spaces or new lines.

Everything else

+all and ?all are not offered: +all lets anyone send as your domain and ?all protects nothing.

Your SPF record

DNS lookups0/ 10

0 in this record · ≈0 estimated total incl. nested includes

Each include, a, mx, exists and redirect costs one lookup, and so does every include nested inside your providers’ records. The checker measures the real total.

Type
TXT
Host / name
@

@ means the root of your domain. Edit your existing SPF record instead of adding a second one.

Value
v=spf1 ~all

Checks

    → Verify the real lookup count with the free SPF, DKIM & DMARC checker

    Authentication is half of deliverability — the other half is your list

    Perfect SPF, DKIM and DMARC do not stop bounces. Sending to invalid, disposable or abandoned addresses hurts your sender reputation just as much. Validate your list before the next campaign.

    → Check a single address with the free e-mail validator

    Create free account — 200 credits

    How to create and publish your SPF record

    1. 1

      List every sender

      Your mailbox provider, newsletter tool, transactional service, CRM, helpdesk, website and billing system — anything that sends with your domain in the From or return-path.

    2. 2

      Pick them here

      Tick the presets and add your own IPs or includes. The record and the lookup count update live.

    3. 3

      Publish one TXT record

      At your DNS provider, edit the existing SPF record or create a TXT record on the root of the domain (host @). Never publish a second SPF record — merge everything into one.

    4. 4

      Verify

      Run our free SPF, DKIM & DMARC checker: it follows every nested include and reports the real lookup total.

    SPF syntax in plain words

    An SPF record starts with v=spf1, lists who may send for the domain and ends with an “all” rule for everyone else.

    ip4 · ip6 · a · mx

    Authorize servers directly

    ip4: and ip6: list addresses or ranges (e.g. ip4:203.0.113.0/24) and cost no DNS lookups. a authorizes the IPs of your domain’s A/AAAA records and mx the servers in its MX records — each costs one lookup.

    include

    Authorize a provider

    include:_spf.google.com pulls in the provider’s own SPF record, so you never have to track their IP ranges. Each include costs one lookup, plus every include, a, mx or exists inside it.

    ~all · -all

    The final rule

    ~all (soft fail) marks everything else as suspicious and lets DMARC decide — the usual choice. -all (hard fail) tells receivers to reject it outright. Never use +all (anyone may send as you) or ?all (neutral, protects nothing).

    10 lookups · 1 record

    The two rules people break

    Evaluating SPF may take at most 10 DNS lookups (RFC 7208); one more and receivers return “permerror”, which counts as an SPF failure. And a domain may have only one v=spf1 record — two records are also a permanent error.

    → Read the complete SPF, DKIM and DMARC guide

    Frequently asked questions

    What is an SPF record?

    A TXT record on your domain that lists the servers allowed to send e-mail for it. Receivers compare the sending IP with the list; together with DKIM and DMARC it stops others from sending as your domain.

    Can I have two SPF records?

    No. A domain must have exactly one TXT record starting with v=spf1. With two, receivers return a permanent error and SPF fails for every message. Merge all mechanisms into one record — that is exactly what this generator does.

    Should I use ~all or -all?

    Both are fine once DMARC is in place. ~all (soft fail) is the common recommendation because DMARC then makes the final decision and forwarded mail is less likely to be lost; -all (hard fail) is stricter and preferred by some providers. Never use +all or ?all.

    What is the 10 DNS lookup limit?

    RFC 7208 caps the DNS queries needed to evaluate an SPF record at 10. Every include, a, mx, exists and redirect counts — including the ones nested inside your providers’ records. Above 10, SPF returns permerror and fails.

    My record needs more than 10 lookups. What can I do?

    Remove services you no longer use; replace a and mx with ip4/ip6 when the IPs are stable; move marketing tools to a subdomain with its own SPF record; or rely on DKIM for providers that sign with your domain. Avoid manual “flattening” of provider ranges — they change without notice.

    Do I need SPF if I already have DKIM?

    Gmail and Yahoo (since February 2024) and Outlook.com (since May 2025) require both SPF and DKIM from bulk senders, and DMARC passes if either one is aligned. Having both is the safe default.

    Where does the SPF record go?

    On the domain used in the return-path (envelope sender) — usually the root of your domain (host @). Some services, such as Amazon SES with a custom MAIL FROM domain, use a subdomain: the SPF record then goes on that subdomain.

    Does this tool store my data?

    No. The record is built entirely in your browser; nothing you type is sent to our servers.

    Authenticated domain + clean list = inbox

    A free account gives you 200 credits to validate e-mail lists in bulk, through the REST API or in real time on your forms.

    Create free account — 200 credits

    No credit card. Credits never expire.