Skip to main content

Web Tools

SPF Record Generator

Build an SPF TXT record for domain email senders.

SPF Record Generator tool

Loading tool…

Jump to a section

About This Tool

SPF tells receiving mail servers which senders are allowed to send email for a domain. This generator builds a DNS TXT value from common SPF mechanisms such as include, ip4, ip6, mx, a, exists, redirect, and the final all policy. It counts DNS-triggering terms in the generated record and warns about the SPF 10-lookup limit, while clearly separating that top-level count from recursive lookups inside referenced policies.

How To Use It

  1. Enter your domain and the sending services or IP addresses that are allowed to send mail for it.
  2. Add include domains supplied by providers such as Google Workspace, Brevo, SendGrid, or other mail services.
  3. Choose whether MX or A/AAAA hosts should be authorized, and avoid ptr unless you have a specific legacy reason.
  4. Select the final all policy. Use ~all during setup or -all after confirming legitimate senders are covered.
  5. Copy the host and TXT value into DNS, then send a test email and inspect headers for SPF pass.

Examples

Google Workspace style setup

Use include:_spf.google.com with ~all while testing, then consider -all after verifying mail delivery.

Dedicated server sender

Add the exact server IP as ip4:192.0.2.10 so that server can send mail for the domain.

Avoid lookup limit failures

Many include, mx, a, exists, ptr, and redirect mechanisms can exceed SPF's 10-DNS-lookup limit and cause permerror.

Useful Notes

What SPF checks

SPF compares the connecting mail server against the domain's published SPF policy. If the server matches an allowed mechanism, SPF can pass. The final all mechanism controls the result for every other sender.

The 10-lookup limit

SPF evaluation has a global limit of 10 DNS-triggering terms across the complete recursive evaluation. Include and redirect can evaluate other SPF records whose terms consume the same limit. This tool counts only the include, a, mx, ptr, exists, and redirect terms visible in the record it generates; it cannot prove the final recursive total without querying and evaluating live DNS.

Choosing all policy

~all is common during setup because it marks unlisted senders as a soft fail. -all is stricter and should be used when you are confident all legitimate senders are included. +all is unsafe because it authorizes everyone. When redirect is used, the generator omits all because SPF requires redirect to be ignored if an all mechanism appears anywhere in the record.

One SPF record only

A domain should publish one SPF TXT record. If you already have one, merge the required mechanisms into a single v=spf1 value instead of creating multiple SPF records.

Limitations

This tool generates and checks SPF syntax locally. It does not query live DNS, confirm provider-specific include contents, verify DKIM or DMARC, or guarantee inbox placement.

FAQ

Where do I add the SPF record?

Usually as a TXT record on the root host @ for the domain. Some providers display the root host differently.

Can I have more than one SPF record?

No. Multiple SPF TXT records for the same host can cause SPF permerror. Merge mechanisms into one record.

Should I use -all or ~all?

Use ~all while setting up or testing. Move to -all when you are confident every legitimate sending service is included.

Does this verify SPF live?

No. It builds the record locally. The displayed lookup count covers top-level DNS-triggering terms only; included or redirected policies may add more. After publishing, use a DNS-aware SPF checker and inspect a fresh test message's headers.