SPF record generator.
Build a valid SPF TXT record without hand-editing DNS syntax. Tick the platforms you send through, add any extra IPs or includes, choose how strict the policy should be, and copy the finished record. It assembles live in your browser — no account, no card.
Sending sources
Search for each platform you send email through and tick it.
Search for your email platform above, or .
This domain's own servers
Authorize the domain itself, if it sends mail directly (not through a platform above).
Other senders & IPs
Anything not in the list — another provider's SPF host, or specific IP addresses.
We add the include: prefix — enter the hostname your provider documents.
Policy for everyone else
What receivers should do with mail from any server not listed above (the all mechanism).
No senders yet, so every message would hit the ~all policy. Add the platforms you send through in step 1.
- Publish it as a TXT record at your root domain — host @ (the bare domain), value the full string above.
- Keep only one SPF record per domain. Merge every sending source into this single line — a second TXT record starting v=spf1 makes both invalid.
- Stay at or under 10 DNS lookups. Each include:, a and mx counts, and an include can trigger more lookups inside itself — ip4: and ip6: are free.
Authentication published? The next step is sending to a clean, verified list.
Verify a listWhat goes into an SPF record
SPF is one of the three DNS records behind email authentication. It answers a single question for receivers: is this server allowed to send for this domain? The SPF, DKIM and DMARC explainer covers how the three fit together, but the record itself is just a list of mechanisms:
- include: — a provider's own senders
- Delegates authorisation to a platform like Google Workspace or SendGrid. Each provider publishes the exact hostname to use, and each include counts toward the 10-lookup budget.
- ip4: / ip6: — your own servers
- Authorise a specific address or CIDR range directly. These cost no DNS lookups, so they're the way to stay under the limit when you send from your own infrastructure.
- the all mechanism — everyone else
- The final word: ~all softfails unlisted senders, -all rejects them. It only means something once every legitimate source above it is listed.
SPF is one record of three
Publishing SPF is the first move, but on its own it doesn't stop spoofing — receivers need a policy telling them what to do when SPF and DKIM fail. That policy is DMARC, and it's what Gmail and Yahoo now require from bulk senders. Once your SPF record is live, follow the step-by-step DMARC setup to add the enforcing layer on top. Authentication proves who you are; it doesn't clean your list — sending to dead addresses still drives bounces and hurts the reputation SPF is meant to protect.
SPF record generator — FAQ
Authentication is only half the job
SPF proves who sends your mail; verifying your list removes the dead addresses that bounce and hurt reputation. Start free with 100 credits, no card required.