SPF record generator
Pick the services that send email for your domain, add any servers of your own, and get one valid SPF record to publish.
What this generator writes
An SPF record is a single TXT record on your domain that starts with v=spf1, lists who may send mail for the domain, and ends with an all term that says what receivers should do with everyone else. This page builds that record from your choices, in the order RFC 7208 expects: your own hosts (mx, a), your IP ranges, the provider includes, then all.
As you choose, it also expands every include through live DNS to count the lookups the finished record will cost. RFC 7208 caps them at 10, including the ones inside each provider's record, and many providers use several. If the total goes over, SPF fails for all of your mail, so check the count before you publish.
Why it matters
Since February 2024, Gmail and Yahoo require every sender to authenticate with SPF or DKIM, and bulk senders to use SPF, DKIM and DMARC together. A correct SPF record is the simplest of the three, and it is one of the two ways a message can pass DMARC (SPF must pass for a Return-Path domain that matches your From domain).
Common mistakes
- Publishing a second record instead of editing the existing one. A domain may have only one SPF record.
- Listing services that don't need it. Many sending platforms use their own Return-Path domain, so your SPF is never checked for their mail. Their setup guide will tell you; including them anyway only costs lookups.
- Forgetting a sender. Billing systems, help desks, CRMs and web forms often send as your domain. Check your DMARC reports for sources you didn't expect before moving to
-all. - Using
+all, which allows anyone to send as you. - Adding
ptr, which RFC 7208 says not to use.
After publishing, run the SPF checker to confirm what the world sees.
Questions
Where do I publish the record?
As a TXT record on the domain itself (the "@" or root record in most DNS panels), not on a subdomain like _spf. If a TXT record starting with v=spf1 already exists, replace it: a domain must have only one.
Why is my provider not in the list?
We only list includes we have checked against each provider's own documentation. For anything else, copy the include your provider gives you into "Other includes". Some services, such as many newsletter tools, use their own Return-Path domain and don't need to be in your SPF at all; their setup guide will say.
Which ending should I choose?
Start with ~all (soft fail) while you check that every sending service is listed. Once DMARC reports show all your real mail passing, you can switch to -all. Never use +all.
Why does the lookup count matter?
SPF allows at most 10 DNS lookups, counting those inside every include. Past that, SPF fails for all your mail. The total here is worked out by expanding each include live.
Do I still need DKIM and DMARC?
Yes. Gmail and Yahoo require bulk senders to have SPF, DKIM and DMARC, and SPF breaks when mail is forwarded, while DKIM survives. Set up all three.
Your DNS is right. Now see how real people react to your email
simmail sends your app's mail to simulated people who open, ignore, junk, click and reply, so you can test what happens after delivery. Start free, no card.