SPF Record Generator
Tick the services that send email for your domain and get a ready-to-paste SPF record, with a live DNS lookup count.
1. Who sends email for your domain?
2. What should happen to senders that fail?
Start with ~all for a few days while you confirm every sender is listed, then move to -all. Never publish +all on a real domain: it tells the world that any server on earth is allowed to send as you.
Your SPF record
Publish this as a TXT record on your root domain (host @ or blank, depending on your DNS provider):
DNS lookup estimate
What each part of your record means
What is an SPF record?
SPF (Sender Policy Framework) is a DNS record that lists the servers allowed to send email using your domain name. When a message arrives, the receiving mail server reads your SPF record and checks whether the sending server is on the list. If it is, the message passes SPF; if it is not, the message fails, and the receiver can treat it as suspicious. SPF is one of three pillars of email authentication, alongside DKIM and DMARC, and it is the main defence against strangers sending email that pretends to come from your domain.
How the 10 lookup limit works
Every include, mx, a, ptr or redirect term in an SPF record can trigger DNS lookups when a receiver checks your record, and the SPF standard caps the total at 10 lookups per check. Go over the limit and your record returns a permanent error, which means SPF fails for everyone, including your real senders. Big providers hide several lookups inside a single include, so the meter above is a floor, not the full count: it counts one lookup per include you add, and nested lookups inside those includes can add more. If you are anywhere near the limit, remove senders you no longer use before adding new ones.
Worked example
A business using Google Workspace for staff email and SendGrid for newsletters needs: v=spf1 include:_spf.google.com include:sendgrid.net ~all. That record uses at least 2 lookups, authorises both services, and soft-fails everyone else. Once a week of clean sending has passed, the owner can safely change ~all to -all. Our guide walks through the whole job step by step: how to create an SPF record.
Common mistakes to avoid
- Two SPF records on one domain. A domain must have exactly one v=spf1 record. Two records means a permanent error; merge everything into a single record instead.
- Forgetting a sender. Your website contact form, your invoicing tool and your CRM all send as you. Miss one and its mail starts failing the day you publish -all.
- Leaving +all in place. Some generators add it by default. It authorises the entire internet and defeats the point of having SPF.
- Publishing and never testing. Send test mail from every service to a Gmail address and check the authentication results before tightening the mechanism.
The natural next step: DMARC
SPF alone does not tell receivers what to do when a message fails, and it checks a behind-the-scenes address your readers never see. DMARC closes both gaps by policing the visible From address and setting your failure policy. When your SPF has been live for a few days, build the matching policy with our DMARC Record Generator.
Frequently asked questions
Where do I publish my SPF record?
In your domain’s DNS, as a TXT record on the root domain (the host field is usually @ or left blank). If you send from a subdomain, that subdomain needs its own record. Changes can take a few minutes to a few hours to spread.
Can I have two SPF records on one domain?
No. A domain must publish exactly one record starting with v=spf1. Two records cause a permanent error and SPF fails for all senders. If a new service asks you to add a record, merge its include into your existing one instead.
What is the difference between ~all and -all?
The ending mechanism says how strict to be with senders that are not listed. ~all is SoftFail: the message is marked suspicious but usually still delivered. -all is Fail: receivers should reject it. Start with ~all while testing, then move to -all once every genuine sender is included.
Why is there a 10 DNS lookup limit?
To stop SPF checks from hammering DNS servers, the standard allows at most 10 lookups per evaluation. Exceed it and the result is a permanent error, which is worse than having no record at all. Shared includes from big providers can hide several nested lookups, so keep your visible count low.
Does SPF stop all spoofing of my domain?
It stops direct server-level spoofing for domains that check it, but SPF checks the envelope address, not the From address your readers see. Pair it with DKIM and a DMARC policy to protect the visible From address and tell receivers to reject failures.
How long does a new SPF record take to work?
Usually minutes, sometimes up to the TTL of your previous DNS values, commonly a few hours. If receivers still see the old record after a day, check you edited the root domain and did not accidentally create a second TXT record.
Do I need SPF if I only send from one mailbox?
Yes. Even a single Google Workspace or Microsoft 365 mailbox needs the matching include, or your mail will fail checks at strict receivers and land in spam. It takes two minutes and this generator writes the record for you.
More tools for site owners
Next step after SPF: set your failure policy with the DMARC Record Generator. Writing for AI search as well? Create your llms.txt file, and read our step-by-step guide on creating an SPF record.
