SPF record generator

What is an Spf Record Generator?

SPF (Sender Policy Framework) is a DNS TXT record that lists the mail servers allowed to send email for your domain. Receiving servers check it to detect forged senders. Together with DKIM and DMARC, a correct SPF record is required by Gmail, Yahoo and Microsoft for reliable delivery.

How to use it

  1. Add every service that sends email as your domain: your email provider, newsletter tool, CRM, helpdesk, website server and so on.
  2. Choose the policy for everything else: ~all (soft fail) or -all (fail).
  3. Publish the record as a TXT record on your domain's root.

Example

v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.10 ~all

This allows Google Workspace, SendGrid and one specific server, and soft-fails everything else.

Mechanisms

  • include: authorises another domain's SPF record, used for email services.
  • ip4: and ip6: authorise specific addresses or ranges.
  • a and mx authorise your domain's A or MX hosts.
  • all matches everything else: -all fail, ~all soft fail, ?all neutral. Never use +all.

Common mistakes

  • More than one SPF record. A domain must have exactly one record starting with v=spf1; two records make SPF fail.
  • The 10-lookup limit. include, a, mx, ptr and exists each cost DNS lookups, including nested ones. More than 10 causes a permanent error. Remove unused services or flatten includes.
  • Forgotten senders such as invoicing systems, leading to rejected mail.
  • SPF checks the envelope sender (Return-Path), not the visible From address; DMARC alignment ties them together.

Frequently Asked Questions

Can a domain have two SPF records?

No. Multiple v=spf1 records cause SPF to fail. Merge all mechanisms into one record.

What is the difference between ~all and -all?

~all is a soft fail, usually accepted but marked suspicious. -all is a hard fail that tells receivers to reject unauthorised mail.

What is the SPF 10 DNS lookup limit?

SPF evaluation may perform at most 10 DNS lookups for mechanisms such as include, a and mx. Exceeding it causes a permanent error.

Where do I find the include value for my email service?

In your provider's documentation, for example include:_spf.google.com for Google Workspace.

You May Also Need