How to Use the SPF Record Generator
Generate an SPF record by choosing your senders and the final qualifier, then publish the single TXT value the tool returns.
- Enter the domain that appears in your sending address, such as example.com.
- Tick each service that sends mail for the domain, then add your own server addresses or extra includes.
- Choose the final qualifier: ~all while you test, -all once the list is complete.
- Select Generate record to build the record and count its DNS lookups live.
- Copy the value into one TXT record at the domain itself, then confirm it with the SPF Checker.
Build an SPF Record
To build an SPF record, list every server and service that sends mail for the domain in one TXT record that starts with v=spf1 and ends with an all mechanism.
SPF Record Syntax
An SPF record starts with v=spf1, followed by mechanisms that each describe allowed senders. ip4 and ip6 list addresses or ranges, a and mx authorize the domain’s own servers, and include pulls in a provider’s record. The final -all, ~all or ?all tells receivers what to do with every other server.
SPF Record Examples
A domain on Google Workspace that also sends newsletters through SendGrid can publish v=spf1 include:_spf.google.com include:sendgrid.net ~all. A company with its own mail server at 192.0.2.10 adds ip4:192.0.2.10 to that record. The generator places address terms first because they need no DNS lookup.
SPF Record 10 Lookup Limit
RFC 7208 lets a receiver make at most 10 DNS lookups while it evaluates one SPF record, counting include, a, mx, ptr, exists and redirect at every nesting level. Past that limit SPF returns a permanent error, and DMARC can no longer rely on it. The generator resolves each include over DNS, shows how many lookups it adds and also counts void lookups, which are limited to two.
SPF Record in DNS
SPF is published as a TXT record at the domain itself, entered as @ or left blank in most DNS panels. A value longer than 255 characters must be split into several quoted strings, which Cloudflare does for you and Route 53 expects you to type. RFC 7208 also advises keeping the whole DNS answer under 512 bytes.
SPF Softfail vs Hardfail
Softfail (~all) asks receivers to accept but mark mail from unlisted servers, while hardfail (-all) asks them to reject it.
| Qualifier | Result for unlisted servers | Typical use |
|---|---|---|
| -all (hardfail) | Fail: receivers may reject the message | When the sender list is complete |
| ~all (softfail) | Softfail: accepted but marked as suspicious | While testing, or alongside an enforced DMARC policy |
| ?all (neutral) | Neutral: no statement either way | Rarely useful, because it gives no protection |
| +all | Pass for every server on the internet | Never, and this generator does not offer it |
Frequently Asked Questions
What Is an SPF Record?
It is a TXT record in a domain’s DNS that lists the servers allowed to send mail with that domain as the envelope sender. Receivers compare the connecting server’s IP address with the list and record a pass or a fail.
Can You Have More Than One SPF Record?
No. Two TXT records that start with v=spf1 at the same name cause a permanent error, so SPF fails for every message. Merge all senders into one record, which is what this generator produces.
Where Are SPF Records Located?
They sit in the DNS zone as a TXT record at the domain name itself, not at a subdomain such as _spf. Each subdomain that sends mail, for example news.example.com, needs its own record.
Can an SPF Record Include Multiple Domains?
Yes, add one include for each provider as long as the total stays within 10 DNS lookups. Some providers nest further includes in their record, so one include can cost several lookups. The live counter shows the real cost of each one.
Related Email Tools
Continue with the guide How to Create an SPF Record. Authorize your legitimate sending services.