SPF record generator
List the servers that send email for your domain and get the SPF record to publish in DNS. The tool checks the address formats and the limit of 10 DNS lookups. It only builds text; it does not look up your domain.
Runs in your browser: nothing you enter is sent anywhere.
How to use it
- Keep mx on if the servers that receive your mail also send it.
- Add the fixed IP addresses of your own mail servers.
- Add the include domains from your email and newsletter providers’ setup guides.
- Pick the policy for everything else and copy the record into a TXT record on your domain.
How it works
The record is a list of mechanisms read from left to right: a matches the domain’s address, mx its mail servers, ip4 and ip6 fixed addresses or ranges, and include hands the check to another domain’s SPF record. The first match decides; if nothing matches, the final all with its qualifier applies.
Example
With mx on, the address 192.0.2.10, the include _spf.example.net and soft fail, the record is:
v=spf1 mx ip4:192.0.2.10 include:_spf.example.net ~all
It needs two DNS lookups (mx and the include) plus whatever _spf.example.net itself uses.
Common mistakes
- Two separate SPF records instead of one merged record.
- Forgetting a service that sends invoices or newsletters, which then fails SPF.
- Using
+all, which allows every server in the world; this tool does not offer it.
- Expecting SPF alone to stop spoofing of the visible From address: that needs DMARC.
Frequently asked questions
What is an SPF record?
A TXT record in your domain's DNS that lists which servers may send email using your domain in the envelope sender. Receiving servers check the sending IP against it. It starts with v=spf1 and ends with an all mechanism that says what to do with everyone else.
Should I use ~all or -all?
Start with ~all (soft fail) while you check that every service that sends for you is listed. Once DMARC reports show no legitimate mail failing, -all (fail) tells receivers to reject the rest. ?all gives no guidance and offers little protection.
What is the 10 lookup limit?
RFC 7208 lets a receiver perform at most 10 DNS lookups while evaluating SPF. a, mx and every include count, and the include targets' own mechanisms count too. Past the limit the result is a permanent error, so the tool flags records that already use more than 10 on their own.
Can I have two SPF records?
No. Two TXT records starting with v=spf1 make the check fail with a permanent error. If a provider asks you to add a record, add its include to your existing one instead.
How long can the record be?
A single string inside a TXT record holds up to 255 characters. Longer SPF values must be split into several quoted strings in the same record, which most DNS panels do automatically; shorter records avoid the question.