Free forever
SPF RecordGenerator
Build a valid SPF TXT DNS record for your domain. Select your authorized senders and copy the result. SPF tells mailbox providers which servers may send as you, and a domain may only publish one record.
14-day free trial · no credit card · cancel anytime
Authorized Senders (include)
Custom IP Addresses
Failure Policy
SPF is the DNS TXT record that tells receivers which servers may send mail as your domain. It lives at your root domain, receivers check it during the SMTP handshake, and a domain may publish exactly one SPF record. Publish two and receivers return permerror, which most treat as a total SPF failure.
The record lists mechanisms: ip4/ip6 for your own servers, include for each provider that sends for you (Google Workspace, Microsoft 365, your ESP), and an mx mechanism when your mail servers themselves send. It ends with an all qualifier that says what happens to everyone else.
How it works
- 01Select the providers and mechanisms that legitimately send as your domain. The generator assembles them into a single syntactically valid v=spf1 record in the right order.
- 02Pick your all qualifier: -all hard-fails unauthorized senders, ~all soft-fails them (a signal, not a block), ?all is neutral. Start with ~all while you verify every sender is included.
- 03Publish the record as a TXT entry at your root domain through your DNS panel. Propagation at common TTLs is minutes to a few hours.
- 04Re-run a check after publishing. The record that matters is the one receivers actually resolve, not the one your DNS panel shows.
When to use it
You connected a new provider (ESP, CRM, helpdesk, invoicing tool) and need it authorized before the first send.
Mail from your domain is landing in spam or failing authentication checks, and nobody remembers what the current record authorizes.
Common mistakes
Publishing two SPF records
Some DNS panels happily accept v=spf1 on more than one TXT entry. Receivers do not merge them: two records means permerror, and most receivers treat that as SPF not passing at all. One record, every provider inside it.
Forgetting a sender that mail depends on
The CRM that sends renewal notices, the billing system, the recruiting tool: if it sends as your domain and is not included, its mail fails SPF. Inventory everything that sends, not just the ESP you signed up last.
Crossing the 10 DNS lookup limit
Each include, a, mx, redirect and exists mechanism costs a lookup, and nested includes count everything they pull in. Past ten lookups receivers stop evaluating and return permerror. Fat provider chains are the usual culprit.
Jumping straight to -all
A hard fail with an incomplete sender list rejects legitimate mail outright. Verify coverage with ~all for a full sending cycle, including the quarterly invoice run you forgot about, before tightening.
Frequently asked questions
Does SPF stop others from spoofing my domain?
Not by itself. Receivers that check SPF will reject or flag unauthorized mail, but plenty of receivers do not enforce it, and SPF alone says nothing about the visible From header. Spoofing protection needs DKIM plus a DMARC policy that tells receivers what to do on failure.
What is the difference between ip4 and include?
ip4 authorizes a specific address range you control and costs no extra DNS lookup. include delegates to another domain record, such as your ESP lookup, and everything that record includes counts toward your ten lookup limit. Use ip4 for your own servers, include for providers.
Why does SPF break when mail is forwarded?
Forwarders re-send your message, so the forwarding server is not in your SPF record and the check fails at the final receiver. This is expected and one of the reasons DMARC exists: it can still pass through the DKIM signature that survives forwarding.
Can I have SPF on my root domain and a subdomain?
Yes. SPF checks the exact sending domain (the SMTP envelope domain), so mail from newsletter.example.com is checked against that subdomain, not example.com. Each level can publish its own single record, and the subdomain does not inherit the parent one.
How long until SPF changes take effect?
As long as the record TTL says, typically minutes to an hour for new records, up to a few hours where caches hold the old value. Lower the TTL a day before planned changes so a rollback is fast.
What does the all qualifier at the end actually do?
It is the verdict for every server your record did not authorize. -all says fail them, ~all says mark but accept, ?all says no opinion. Omitting it entirely means your record authorizes some servers and stays silent about the rest, which receivers interpret loosely.
Related free tools
These tools answer the question once. Continuous monitoring re-checks your domain every 6 hours and alerts you when the answer changes, from $14/mo. Pricing · Guides · FAQ
This answers once. Monitoring answers every 6 hours.
LitInboxes re-checks DNS, DMARC, and blocklists on a schedule and emails you when the answer changes. Start with a 14-day free trial.
14-day free trial · no credit card · cancel anytime