SPF record generator
Tick the services that send mail on behalf of your domain and we'll build a standards-compliant SPF record. The lookup counter runs live — you see the limit of 10 while building the record, not once your mail starts landing in spam.
Who sends mail as your domain?
Tick all of them. A service you forget will have its mail marked suspicious the moment the record goes live.
Additional IP addresses (optional)
Add your server's static IP here if it has one. IP mechanisms cost no DNS lookup — they don't touch the limit of 10, so prefer them over includes where you can.
What happens to senders not on the list?
Your SPF record
DNS lookups: 1/10v=spf1 mx ~all
How to add it to DNS
- Record type
- TXT
- Name / Host
- @ (some panels want this blank or your domain name)
- Value
- the full record generated above
- TTL
- 3600 (or the panel default)
Why only one record?
A domain may publish only ONE SPF record. Adding a second TXT record for a new service is the most common mistake: the standard requires a 'permerror' result and your domain is evaluated as if it had no SPF at all.
That's why this tool produces a single line. If you already have an SPF record, don't add this one alongside it — replace the existing record with it.
Why prefer IPs over includes?
Every include costs one DNS lookup and you only get 10. The ip4: and ip6: mechanisms cost nothing.
For sources with a stable address, such as your own server, writing the IP preserves the budget and skips a resolution step. For large providers (Google, Microsoft) always use the include instead — they change their IP ranges regularly, and hardcoding those addresses will silently lose you mail one day.
After you publish
The change propagates after the record's TTL, usually 5 minutes to an hour. Once it has, verify the record with the SPF checker: it shows your real lookup count, every service in the chain and any broken includes.
SPF alone isn't enough. After publishing, confirm your DKIM signature works and publish a DMARC policy — without all three, your domain isn't meaningfully protected against spoofing.
Frequently asked questions
How do I create an SPF record?
Identify every service that sends as your domain, combine their official include values into a single TXT record and end it with ~all or -all. The tool on this page does that for you; copy the record and publish it as a TXT record in your DNS panel.
I already have an SPF record — can I add a second one?
No. A domain may only have one SPF record; a second one invalidates both. Edit the existing record and add the new service inside it.
Should I choose ~all or -all?
If you're setting this up for the first time, start with ~all. After a few weeks of DMARC reports, once you're confident every service that sends as you is listed, switch to -all.
Where do I add the SPF record?
In your DNS panel, as a TXT record named '@' (or your domain itself). It's published for the root domain, not a subdomain.
What happens if I exceed the 10 lookup limit?
The record returns 'permerror' and receivers treat your SPF as if it didn't exist. The record stays in DNS but provides no protection.