SPF Record Generator
Build a correct SPF record in seconds: tick the services that send email as your domain, add any of your own servers, pick the failure policy, and copy the finished TXT record. Generated entirely in your browser — nothing is sent to us.
What is an SPF record?
SPF (Sender Policy Framework, RFC 7208) is a DNS TXT record that lists every server allowed to send
email using your domain. Receiving servers look it up on every message: mail from a listed source
passes; mail from anywhere else is handled according to your all policy. Together with
DKIM and DMARC it is one of the three authentication checks that Google, Yahoo and Microsoft now
require from bulk senders.
Rules this generator enforces for you
- One record only — multiple SPF records are a permanent error (permerror); merge instead of adding.
- The 10-DNS-lookup limit — every
include,aandmxterm costs lookups; exceed 10 and SPF breaks. The counter below the record warns you as you approach it. - Policy order — mechanisms first, the
allqualifier last.
After you publish
DNS changes take minutes to a few hours to propagate. Then verify with the sender compliance checker (which also checks DKIM and DMARC), and consider free monitoring so you are emailed if the record ever changes or disappears.
Frequently asked questions
I already have an SPF record. Can I just add this one?
No — two SPF records is an automatic permanent error. Take your existing record and add the new
mechanisms into it (everything between v=spf1 and the all term), keeping
a single record.
Why does the lookup count matter?
Receivers stop evaluating after 10 DNS lookups and return a permerror, which DMARC treats as an
SPF failure. Each include:, a, mx, exists: and
redirect= costs at least one lookup — and includes can nest. If you are close to the
limit, remove services you no longer use.
Does SPF alone stop spoofing?
No. SPF checks the envelope sender, which recipients never see, and it breaks on forwarding. You need DKIM and a DMARC policy for From:-address protection — generate the DMARC record here.
How this tool works: This tool runs in your browser and on our server in real time. Depending on the tool, results are computed directly from the input you provide or retrieved from live, authoritative data sources at the moment you run a lookup. We do not sell your data, and your lookups are kept private — any history shown here is stored only on your device.