SPF · generator

SPF Record Generator

Tick the services that send email for your domain, add your own servers, choose how strict to be, and get one validated SPF record ready to publish.

Build

updates as you type

Your domain (optional)

Used to show where to publish the record and to resolve a and mx when counting nested lookups.

Services that send email for you

Your own mail servers

Servers in the domain’s MX recordsmx The domain’s own web/IP addressa

IPv4 addresses or ranges

IPv6 addresses or ranges

One per line, or separated by commas. These cost no DNS lookups.

Other includes

Include domains from your providers’ setup instructions, one per line.

Mail from servers not listed above

Soft fail ~allAccept but mark as suspicious. Safest while you are still finding senders. Fail -allTreat as not authorised. Use when the list is complete. Neutral ?allNo statement. Gives no protection; testing only.

Your SPF record

How to publish your SPF record

Tick every service that sends mail with your domain in the From or Return-Path address: your mailbox provider, newsletter tool, helpdesk, CRM or invoicing system.
Add the IP addresses of your own mail servers, if you run any. Ranges such as 192.0.2.0/24 are allowed.
Choose ~all while you are still finding senders, and -all once you are sure the list is complete.
Create one TXT record at the root of your domain (host @) with the generated value. If a v=spf1 record already exists, replace it instead of adding a second one.

Each include costs at least one DNS lookup, and providers often nest more includes inside theirs. Count nested lookups expands them through DNS so you see the real total before publishing; the limit is 10. Afterwards, verify the live record with the SPF checker.

Frequently asked questions

Where do I publish the SPF record?

As a TXT record on the domain itself: host @, or the bare domain name, depending on your DNS provider. Subdomains that send mail need a record of their own.

I already have an SPF record. What now?

Merge them. Copy every include, ip4 and ip6 term from the existing record into this generator, add the new service and replace the old record. Two v=spf1 records make SPF fail.

Why is the nested lookup count higher than my number of includes?

Providers’ SPF records often include further records of their own, and every level counts towards the limit of 10.

Does a domain that sends no email need SPF?

Yes. Publish v=spf1 -all so that no server can pass SPF for it, together with a DMARC policy of p=reject.