BUY WEBSITES
BUY DOMAINS
LOGIN
SIGNUP
SPF Record Generator
An SPF record generator assembles the v=spf1 TXT record that tells receiving mail servers which hosts are allowed to send email for your domain, in the exact mechanism order and syntax the Sender Policy Framework expects. Get the syntax wrong, list too many include: mechanisms, or finish with +all, and the record either fails validation or quietly authorizes spoofers, so the record is worth building deliberately rather than by hand.
This tool builds the string from simple inputs, dynamic include:, ip4:, and ip6: rows plus a, mx, and an all policy, and checks the two limits people break most: the 10 DNS-lookup cap and the 255-character single-string limit. It is free and runs entirely in your browser, so nothing you type is uploaded.
include:)
One mail provider per row, e.g. _spf.google.com, sendgrid.net, servers.mcsv.net, spf.protection.outlook.com.
ip4:)
A single IP like 198.51.100.7 or a CIDR range like 198.51.100.0/24.
ip6:)
e.g. 2001:db8::1 or a range like 2001:db8::/32.
example.comTXT🔒 Private: everything runs in your browser. Nothing you paste is uploaded.
How to use the SPF record generator
Enter your sending domain, add each provider and IP that sends mail on its behalf, choose how strict the policy should be, then copy the generated record into a single TXT record at the root of your domain.
List every service that sends mail, then choose a strict all policy
Map your real senders before you build anything: your mailbox host (Google Workspace, Microsoft 365), every transactional or marketing platform (SendGrid, Mailchimp, Amazon SES), and any servers you send from directly. Add a provider’s published include host on its own row, or paste a sending IP into the IPv4 or IPv6 rows. Finish with the all mechanism that matches your confidence: -all rejects everything not listed and is the goal once your list is complete, while ~all softfails and is the safe choice while you are still confirming senders.
Watch the DNS-lookup counter and stay under ten
SPF caps the number of mechanisms that trigger a DNS lookup at ten per evaluation: include, a, mx, ptr, and exists all count toward it, while ip4 and ip6 cost zero. Cross the limit and conforming receivers return a permerror and ignore your SPF entirely, so a record meant to protect you stops working. The live counter turns amber as you approach ten and red when you exceed it. Remember that each include can chain into further lookups inside the provider’s own record, so the real total is often higher than the headline number, which is why keeping visible headroom matters.
Publish one TXT record at the root and keep it under 255 characters
Publish the generated string as a single TXT record at the root of your domain, the host shown beside the output, not at a subdomain or in a SPF-type record, which is deprecated. A domain must have exactly one SPF record; two v=spf1 records cause a permerror, so merge senders into one. A single DNS character-string cannot exceed 255 bytes, so the length pill warns as you approach it. If the record grows past that, split it into multiple quoted strings inside the same TXT record, or flatten chained includes into ip4 and ip6 entries.
SPF record generator frequently asked questions
Q1What is an SPF record and why do I need one?
An SPF record is a TXT DNS record that lists the servers allowed to send email for your domain. Receiving servers check the sending IP against it to decide whether mail is legitimate. Without one, anyone can spoof your domain in the From address, and many providers will reject or junk your legitimate mail, especially since SPF is now a prerequisite for inbox placement at large mailbox providers.
Q2What is the difference between -all, ~all, and +all?
The all mechanism is the catch-all policy for any server not otherwise listed. -all is a hard fail that tells receivers to reject unlisted senders and is the strict goal. ~all is a softfail that marks unlisted mail as suspicious without rejecting it, useful while you confirm your sender list. ?all is neutral and enforces nothing. +all authorizes any server to send as your domain, which defeats SPF entirely and should never be used.
Q3Why does SPF limit me to 10 DNS lookups?
RFC 7208 caps the mechanisms that cause a DNS lookup, include, a, mx, ptr, and exists, at ten per evaluation to prevent SPF from being used to amplify denial-of-service traffic. Exceed it and receivers return a permerror and ignore your record. Because each include can chain into more lookups inside the provider’s own SPF, the practical limit arrives faster than expected, so flattening includes into ip4 and ip6 entries, which cost no lookups, is the usual fix.
Q4Where do I publish the SPF record?
Publish it as a single TXT record at the root of the sending domain, the host shown next to the generated record, using your DNS provider’s control panel. Do not use the deprecated SPF record type, and do not create more than one v=spf1 record, since two of them cause a permerror. Changes propagate with the record’s TTL, typically within minutes to a few hours, after which you can verify it with any SPF lookup tool.
Q5Is this SPF generator free and does it send my data anywhere?
Yes, it is completely free and entirely client-side. The record is assembled in your browser with JavaScript, and nothing you type, your domain, includes, or IP addresses, is uploaded, logged, or stored anywhere. You can build and validate a record for an unpublished or internal domain with no privacy risk, and the tool keeps working even after you go offline once the page has loaded.
