SPF

SPF Record Setup Guide

What SPF authorizes, the 10 DNS lookup limit, and how to publish a record that does not quietly break.

SPF Record GeneratorRun it on your own domain first. Free, no account.

What is an SPF record?

SPF (Sender Policy Framework) is a DNS TXT record that lists which servers are allowed to send email for your domain. When a mailbox provider receives a message, it checks your SPF record to confirm the sending server is authorized. That is a key signal for landing in the inbox instead of spam.

How to use this generator

Pick the services that send on your behalf (Google, Microsoft 365, SendGrid, Mailgun, Amazon SES and more), add any custom IPs, choose your enforcement policy, and copy the generated record into a TXT record on your domain. Then verify it resolves correctly before you rely on it.

Common SPF mistakes

Publishing more than one SPF record, exceeding the 10 DNS-lookup limit, or using a strict -all before you have listed every sender are the most common ways SPF breaks deliverability. Keep a single record, stay under 10 lookups, and start with ~all (soft fail) while you validate.

The 10 DNS lookup limit

Every include: mechanism in your record costs at least one DNS lookup, and the includes it points at cost more. RFC 7208 caps the total at 10. Cross it and SPF returns permerror, which most receivers treat as a failure even though the record looks fine to the eye. Count the tree before you add another vendor.

SPF on its own is not enough

SPF breaks when mail is forwarded, because the forwarding server is not in your record. That is why DMARC accepts either SPF or DKIM alignment: DKIM survives forwarding, SPF often does not. Publish all three, and treat SPF as one leg of the stool rather than the whole authentication story.

Check yours now

Build or rebuild the record with the free SPF record generator, publish it, then confirm what actually resolves with the free email health check. If the lookup count is the problem rather than the syntax, the free SPF flattener is the next stop, and SPF flattening covers the trade-off before you commit to it.

How to publish an SPF record

Generate, publish and verify an SPF TXT record for a sending domain.

List every senderWrite down every service that sends email as your domain: your mailbox provider, your marketing platform, your billing system, your helpdesk. A sender you forget is a sender that starts failing.
Generate one recordSelect those services in the generator and add any custom IP addresses. A domain must have exactly one SPF record, so everything goes in the same string.
Choose a policyStart with ~all (soft fail) while you confirm the list is complete. Move to -all once you are confident nothing legitimate is missing.
Publish it as a TXT recordIn your DNS provider, create a TXT record on the root of the domain (host @ or the domain name itself) with the generated value.
Verify it resolvesWait for the TTL to expire, then re-run the check. Confirm there is exactly one SPF record and that the lookup count is under 10.

Frequently asked questions

Is this SPF generator free?

Yes. Generating and validating an SPF record is completely free, no signup required.

Can I have more than one SPF record?

No. A domain must have exactly one SPF TXT record. If you use multiple senders, combine all of their include: mechanisms into a single record.

What is the 10 DNS lookup limit?

SPF allows a maximum of 10 DNS lookups when it is evaluated. Going over causes a permerror and SPF fails. Use an SPF flattener to stay under the limit.

Should I use ~all or -all?

Start with ~all (soft fail) while you confirm every legitimate sender is listed, then move to -all (hard fail) once you are confident, for the strongest protection against spoofing.

How do I check if my SPF record is valid?

Run the free email health check on your domain. It resolves the record, counts the DNS lookups, and flags duplicate records and syntax errors, which are the three failures that break SPF most often.

Does SPF stop spoofing on its own?

No. SPF authorizes sending servers but says nothing about the From address your reader actually sees. DMARC is what ties SPF (or DKIM) back to the visible From domain, so publish all three.

More guides

These tools answer the question once. Continuous monitoring re-checks your domain every 6 hours and alerts you when the answer changes, from $14/mo. Pricing