Free tool

SPF Record Generator

List the servers and services authorized to send email using your domain. Generate a syntactically valid SPF TXT record and copy it straight into your DNS.

English
Include domains include The SPF records of every email service that sends mail using your domain. Most teams need at least one include for their mail provider. You can paste a comma-separated list, or use the quick-add buttons below.
Quick add:
IPv4 addresses ip4 IPv4 addresses or CIDR ranges of servers you send mail from directly. Most teams using only email providers leave this blank. Paste a comma-separated list to add many at once.
All qualifier all What receivers do with mail from sources NOT covered by the mechanisms above. ~all is the recommended starting point while you confirm your sender list. -all is the strictest. Never use +all.
Advanced options IPv6, A and MX records, exists checks
IPv6 addresses ip6 IPv6 addresses or CIDR ranges. Same idea as IPv4. Most senders do not need this.
Exists checks exists Advanced. Performs a DNS lookup of a computed domain, often using SPF macros like %{i} for the sending IP. Used for whitelist or geo checks. Counts toward the 10 DNS lookup limit.
Background

What is an SPF record?

SPF (Sender Policy Framework) is a DNS TXT record that lists every server and service authorized to send email using your domain. When a receiving mail server gets a message claiming to come from your domain, it looks up your SPF record and checks whether the sending IP is on your approved list. If not, the policy in your record tells the receiver what to do with the message.

A minimal SPF record looks like this:

v=spf1 include:_spf.google.com ~all

Three things define what it does:

  • The version (v=spf1), which is required and always first.
  • One or more mechanisms (include, ip4, ip6, a, mx, exists) that list authorized sources.
  • An all qualifier (~all, -all, ?all) at the end that tells receivers what to do with everything else.

SPF gives receivers a definitive answer about which IPs may send mail using your domain. Pair it with DKIM and DMARC for a full sender-authentication setup.

Step by step

How to create an SPF record

This generator builds your record in three steps:

  1. Enter your sending domain

    This is the apex domain you send email from, for example yourdomain.com. SPF goes at the apex, not at a subdomain.

  2. List your authorized sending sources

    For most teams, this is one or more include references to your email service providers (Google Workspace, Microsoft 365, SendGrid, Mailgun) plus any IP addresses you send from directly. Use the quick-add chips for common ESPs.

  3. Pick the all qualifier

    Start with ~all (SoftFail) when you first publish so unmatched senders land in spam rather than getting rejected. Move to -all (Fail) once you have confirmed every legitimate sender is covered.

Click Generate SPF record to build the TXT entry, then copy it into your DNS.

Deployment

How to publish your SPF record

You publish SPF as a TXT record at the apex of your domain. The hostname is the domain itself, not a subdomain. Steps vary slightly per DNS provider, but the shape is the same:

  1. Sign in to your DNS provider and open the DNS settings for your domain.

  2. Add a new record. Set the type to TXT.

  3. Set the host or name field to @, or leave it blank. Most providers accept either to mean the apex.

  4. Paste the generated record into the value or content field.

  5. Save. DNS propagation typically completes within a few minutes.

If your domain already has an SPF record, edit it instead of adding a new one. A domain may publish only one SPF record. Two records cause every receiver to return a permanent error and SPF fails for all your mail.

Reference

SPF mechanisms and qualifiers

Mechanism Matches Example
all Everything. Always last in the record, prefixed with a qualifier. ~all
ip4 An IPv4 address or CIDR range. ip4:192.0.2.1
ip6 An IPv6 address or CIDR range. ip6:2001:db8::1
a The A or AAAA record of the domain (or an alternate domain). a or a:mail.example.com
mx The MX record of the domain. mx or mx:example.com
include Another domain's SPF record. Adds its authorized senders to yours. include:_spf.google.com
exists Whether an A record exists at a computed domain. Used for whitelist and geo checks. exists:%{i}.spf.example.com
redirect Modifier. Replaces this record entirely with the SPF record at the named domain. redirect=spf.example.com
ptr Reverse-DNS lookup. Deprecated and discouraged by RFC 7208 because of cost and unreliability. Not recommended.
Qualifier Symbol Meaning
Pass + (default) The source is authorized. Default if no qualifier is given.
Fail - The source is not authorized. Receivers reject the message.
SoftFail ~ The source is not authorized but receivers should be lenient. Often delivered to spam. Recommended while you are confirming your sender list.
Neutral ? No assertion. Treated the same as having no SPF policy on unauthorized sources.
FAQ

Frequently asked questions

What is an SPF record generator?

An SPF record generator builds the TXT entry you publish in DNS to declare which servers can send email using your domain. You list your sending sources (email providers, transactional services, and any IP addresses you send from directly), pick how strict the policy should be, and the generator outputs a syntactically valid record you can paste straight into your DNS provider.

How to implement an SPF record for your domain?

Three things have to happen. First, identify every legitimate sender. This includes your mail provider (Google Workspace, Microsoft 365), transactional services (SendGrid, Mailgun, Postmark), marketing platforms (Mailchimp, Klaviyo), and any servers you send from directly. Second, generate your record with this tool covering all those sources. Third, publish it as a TXT entry at your domain's apex, then start with ~all and tighten to -all after a few weeks of clean reports.

What's the SPF record format?

An SPF record is a single TXT string starting with v=spf1, followed by space-separated mechanisms, ending with an all qualifier. A working example: v=spf1 ip4:192.0.2.1 include:_spf.google.com include:mailgun.org ~all. Each mechanism describes one authorized sending source. The all qualifier at the end tells receivers what to do with senders that do not match any earlier mechanism.

What is the difference between -all, ~all, ?all, and +all?

The qualifier on all controls how receivers treat unauthorized sources. -all (Fail) means reject the message. ~all (SoftFail) means accept but mark as suspicious. ?all (Neutral) means no assertion, treated the same as having no policy on those senders. +all (Pass) authorizes everyone, which makes SPF useless and should never be published. Best practice is to start with ~all while you confirm your sender list, then move to -all once you are confident.

How do I avoid the SPF 10 DNS lookup limit?

SPF allows a maximum of 10 DNS lookups during evaluation. Each include, a, mx, exists, redirect, and the deprecated ptr mechanism counts as a lookup, and each include adds the lookups inside the included record on top of that. Exceeding the limit returns permerror, which fails SPF for every message. To stay under the cap, audit your record for unused includes, replace nested includes with flattened IP lists where practical, and consider an SPF flattening service if your sender stack genuinely needs more than 10 lookups.

Can I have more than one SPF record per domain?

No. A domain may publish only one SPF record. Two or more cause every receiver to return permerror and SPF fails for all of your mail. To add a new sender, edit your existing record and append a new include or ip4 mechanism. Subdomains can have their own separate records, but the apex domain itself is limited to one.