Web Tools
SPF Record Generator
Build an SPF TXT record for domain email senders.
Sending sources
Default policy
Soft fail: mail from unlisted senders is suspicious but may still be accepted.
Generated SPF TXT record
Add this as a TXT record at the root host unless your provider tells you otherwise.
@v=spf1 include:_spf.google.com ip4:192.0.2.10 mx ~allEstimated DNS lookup count: 2 / 10
The SPF record shape looks valid. Publish it, then send a fresh test email and inspect headers.
Mechanism breakdown
| Part | Value | Meaning |
|---|---|---|
| Version | v=spf1 | Required SPF version tag. |
| Include | include:_spf.google.com | Authorize another provider's SPF policy. |
| IPv4 | ip4:192.0.2.10 | Authorize an IPv4 sender or CIDR range. |
| MX | mx | Authorize hosts listed in the domain's MX records. |
| All policy | ~all | Controls the default result for all other senders. |
About This Tool
SPF tells receiving mail servers which senders are allowed to send email for a domain. This generator builds a DNS TXT value from common SPF mechanisms such as include, ip4, ip6, mx, a, exists, redirect, and the final all policy. It also estimates DNS lookups so you can avoid the SPF 10-lookup limit before publishing the record in Cloudflare, a registrar, or another DNS dashboard.
How To Use It
- Enter your domain and the sending services or IP addresses that are allowed to send mail for it.
- Add include domains supplied by providers such as Google Workspace, Brevo, SendGrid, or other mail services.
- Choose whether MX or A/AAAA hosts should be authorized, and avoid ptr unless you have a specific legacy reason.
- Select the final all policy. Use ~all during setup or -all after confirming legitimate senders are covered.
- Copy the host and TXT value into DNS, then send a test email and inspect headers for SPF pass.
Examples
Google Workspace style setup
Use include:_spf.google.com with ~all while testing, then consider -all after verifying mail delivery.
Dedicated server sender
Add the exact server IP as ip4:192.0.2.10 so that server can send mail for the domain.
Avoid lookup limit failures
Many include, mx, a, exists, ptr, and redirect mechanisms can exceed SPF's 10-DNS-lookup limit and cause permerror.
Useful Notes
What SPF checks
SPF compares the connecting mail server against the domain's published SPF policy. If the server matches an allowed mechanism, SPF can pass. The final all mechanism controls the result for every other sender.
The 10-lookup limit
SPF evaluation has a hard limit of 10 DNS lookups for mechanisms such as include, a, mx, ptr, exists, and redirect. This tool estimates that count from your chosen mechanisms and warns before the generated policy becomes risky.
Choosing all policy
~all is common during setup because it marks unlisted senders as a soft fail. -all is stricter and should be used when you are confident all legitimate senders are included. +all is unsafe because it authorizes everyone.
One SPF record only
A domain should publish one SPF TXT record. If you already have one, merge the required mechanisms into a single v=spf1 value instead of creating multiple SPF records.
Limitations
This tool generates and checks SPF syntax locally. It does not query live DNS, confirm provider-specific include contents, verify DKIM or DMARC, or guarantee inbox placement.
FAQ
Where do I add the SPF record?
Usually as a TXT record on the root host @ for the domain. Some providers display the root host differently.
Can I have more than one SPF record?
No. Multiple SPF TXT records for the same host can cause SPF permerror. Merge mechanisms into one record.
Should I use -all or ~all?
Use ~all while setting up or testing. Move to -all when you are confident every legitimate sending service is included.
Does this verify SPF live?
No. It builds the record locally. After publishing, send a test message and use an email header analyzer or live DNS lookup to confirm real results.
Related Tools
DNS Record Validator
Check DNS record values before adding them to a provider.
DMARC Record Generator
Build a DMARC TXT record for domain email protection.
Email Header Analyzer
Inspect SPF, DKIM, DMARC, and delivery path headers.
HTTP Status Code Lookup
Find HTTP status meanings and next steps.