SPF record generator

What the generator does

Choose the services that send mail as your domain, add your own servers if you have any and pick how the record should end. The generator writes the SPF record, gives you a zone-file line (the plain-text format DNS servers store records in), shows how many of the 10 allowed DNS lookups the record uses and warns you about anything that would cause trouble. Because the record is built from your choices, its syntax is always right.

An SPF record is one line of text in your DNS, but a small mistake in it can quietly break delivery. The limit of 10 DNS lookups is one of the most common ways a record fails, which is why the generator counts them.

The generator makes no DNS requests, so it does not know what your DNS already holds. If you already have an SPF record, merge the new terms into it. Your choices go to our server, which builds the record. They are not part of our routine logs and are held in memory for at most a day. On the website, Google Analytics also records what you enter, as the privacy policy explains.

How to build your record

1. Choose your mail servicesPick every service that sends mail as your domain. The list has 18, among them Google Workspace, Microsoft 365, SendGrid, Mailchimp, Amazon SES, Mailgun, Postmark, Zoho Mail and Fastmail. Each one adds the include its provider documents. For a service that is not listed, type its include domain under Other includes.
2. Add your own serversEnter IPv4 or IPv6 addresses or networks for mail you host yourself. Turn on "Allow my MX servers" or "Allow my domain's A record" only if those hosts really send mail.
3. Pick the endingThe "Everything else" menu says what happens to mail from every other server. ~all (softfail, the default) marks it as suspicious, -all (fail) asks receivers to reject it and ?all (neutral) makes no statement. The questions below explain which to use. If another domain already holds your full policy, the advanced option "Redirect to another domain" hands the decision to it and the record needs no ending.
4. Publish itCreate one TXT record on your domain, with the host shown as @ in most panels, and paste in the generated value. Delete or merge any older SPF record. Then check the result with the SPF checker once DNS has updated.

Understanding the output

For a domain that sends through Google Workspace and SendGrid, with a softfail ending, the generator produces:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

• The record and its length. Terms always come in the same order: mx, a, ip4, ip6, your includes, then the ending. A record longer than 255 bytes is also shown as several quoted strings inside one TXT record, together with a zone-file line.
• The lookup count. Each include, a, mx and redirect costs one lookup, plus whatever the included record uses itself. The generator has those inner counts for only a few services, from a snapshot taken when it was built, and providers change their records. When any are unknown, or you add an include of your own, the count is shown as a minimum. Publish the record and run the SPF checker for the exact number.
• Warnings and errors. Warnings cover ?all, private or loopback addresses that receivers will never see, a record with 8 or more lookup terms and a record longer than 450 bytes. Errors cover invalid addresses and prefixes and a record that needs more than 10 lookups. A record with an error is not shown, so you cannot copy it by mistake. Duplicate terms are removed for you.
• The host name. The record belongs on the domain itself, shown as @ in most DNS panels.

Mistakes to avoid when publishing

• Adding a second SPF record. Edit the existing one. Two records are invalid, and receivers ignore both.
• Forgetting a sender. Invoicing tools, CRMs, ticket systems and web forms often send as your domain. Look at the headers of your sent mail before you move to -all.
• Using too many services. Past 10 lookups the generator refuses to show a record. Move bulk senders to a subdomain such as news.example.com with its own SPF record, or remove services you no longer use.
• Using a or mx out of habit. They add lookups and may allow servers that never send mail.
• Listing a private address. An address such as 10.0.0.5 never appears as the sender of mail from the internet. List the public address of your mail server instead.
• Letting the DNS host change the value. Some panels need the value in quotes and others add them. Some want a long value split into 255-byte parts. Check what was published with a TXT lookup.
• Expecting subdomains to inherit. SPF does not pass from a parent domain to its subdomains. Each domain that appears in the return path needs its own record. A subdomain that never sends mail can publish v=spf1 -all.

How it works

The generator cleans your input (lowercase domains, standard IP notation, no stray spaces), checks each term against RFC 7208 and writes the record. It adds the lookup terms in your record to the inner counts it knows for each listed service. If a service's inner count is unknown, the total is marked as a minimum. The same function runs behind the REST API and the MCP server.

Standards

• RFC 7208: SPF syntax, qualifiers, the limit of 10 lookups and the rule that a domain publishes one record. It also dropped the separate SPF record type, so SPF lives in TXT records.
• RFC 1035: TXT records and the 255-byte limit of one character string. RFC 7208 joins the strings of a TXT record with nothing between them.
• RFC 5321: the SMTP envelope sender that SPF checks.