SPF Record Generator
Build an SPF TXT record for your email services, with a lookup count.
About this tool
Enter your domain, tick each service that sends email for you, add any server IPs and other include domains, and choose the policy for everything else (~all or -all). You get the TXT record to add at your DNS host, with an estimate of DNS lookups and warnings.
How SPF works
SPF (Sender Policy Framework, RFC 7208) is a TXT record at your domain that lists which servers may send email using your domain in the envelope sender. Receiving servers look it up and mark mail from unlisted servers as failing. The record starts with v=spf1, followed by mechanisms: include: for a provider's list (include:_spf.google.com), ip4:/ip6: for your own servers, mx and a for your mail and web servers, and finally an all qualifier for everything else. ~all (soft fail) is the safe choice while you confirm every sender, and -all (hard fail) is stricter once you're sure. Two limits trip people up. A domain may have only one SPF record, so you merge rather than add, and evaluating it may take at most 10 DNS lookups. Each include, a or mx counts, plus any nested inside providers' records, and exceeding the limit makes SPF fail for everyone. The tool estimates lookups for common providers and warns as you approach the limit. Honest limits: provider include values change occasionally, so check each provider's current setup guide. SPF only checks the envelope sender, not the From address people see, so pair it with DKIM and DMARC. The DMARC record generator and the email header analyzer are related.
Frequently asked questions
What should my SPF record be for Google Workspace?
v=spf1 include:_spf.google.com ~all, plus includes for any other services that send as your domain.
Can I have two SPF records?
No. Multiple SPF records cause a permanent error, so combine everything into one.
What is the SPF 10 lookup limit?
Evaluating SPF may trigger at most 10 DNS lookups. More causes a permerror and failed checks.
Is anything uploaded or fetched?
No. What you paste is processed in your browser, and nothing is fetched, stored or sent.