Free Online Tool

SPF Record Generator

Select your mail providers, add custom IPs, set your catch-all policy — and get a ready-to-publish SPF record in seconds.

0 / 10
No DNS lookups used — add your mail providers below

1 Your Domain

The SPF record is published at your root domain — e.g. example.com, not www.example.com

2 Mail Providers

Select every service that sends email on behalf of your domain. Each adds one DNS lookup toward the 10-lookup limit.

Not listed above? Add a custom include domain (optional)

Use this for any mail service not listed above. Each counts as one DNS lookup.

3 Authorised IP Addresses (optional)

Supports single IPs (203.0.113.5), IPv4 subnets (203.0.113.0/24), and IPv6 ranges (2001:db8::/32). IP addresses never count toward the 10 DNS lookup limit.

4 Catch-All Policy

Receiving servers will reject any email not sent from the servers listed above.

FAQ

Frequently asked questions

Everything you need to know about generating and publishing SPF records.

The email standard (RFC 7208) allows a maximum of 10 DNS lookups when evaluating an SPF record. Each include:, a, mx, ptr, redirect, and exists counts as one lookup. If you exceed 10, receiving servers return a PermError and SPF fails for all your mail. ip4: and ip6: entries do not count toward this limit.
No. You must have exactly one TXT record starting with v=spf1 at your domain. Multiple SPF records cause a PermError. If you currently have one, delete it before publishing the new one generated here.
Use ~all (SoftFail) initially while you verify all your legitimate mail passes. Once you are confident, switch to -all (Fail) for strict enforcement. -all means unlisted senders get rejected outright rather than marked as suspicious.
No. ip4: and ip6: mechanisms do not require a DNS lookup and do not count toward the 10-lookup limit. If a server has a fixed IP, authorising it via ip4: is better than adding another include:.
No. SPF only authenticates the envelope sender (Return-Path), not the visible From address. You also need DKIM for cryptographic signing, and DMARC to tie both together and enforce a policy. All three work as a system.

Also set up DMARC

SPF alone is not enough. DMARC enforces policy when SPF or DKIM fails and stops spoofing of your visible From address.

Generate DMARC Record