SPF Record Generator
Choose the services that send email for your domain, add your own servers' IP addresses and pick a policy. The tool builds a valid v=spf1 TXT record, counts DNS lookups against the limit of 10 and tells you exactly where to publish it.
Last updated:
Your SPF record
Add it to your DNS
- Type
- TXT
- Host / Name
- @ (example.com)
- Value
- TTL
- 3600 (1 hour, or your host's default)
Replace any existing TXT record starting with v=spf1: a domain may only have one. Then verify it with the SPF Record Checker.
What each part means
How to use the SPF Record Generator
- Enter your domain so the DNS instructions show the right host name.
- Tick every service that sends mail as your domain: your mailbox provider, newsletter tool, help desk, store platform and so on.
- Add your own servers: IP addresses or CIDR ranges, and tick mx or a if your mail server is the same as those hosts.
- Pick a policy. Start with ~all (soft fail) and switch to -all once your DMARC reports look clean.
- Copy the TXT record and add it at your DNS host as a single TXT record on the root of your domain (@), replacing any older SPF record.
SPF syntax reference
An SPF record is one TXT record that starts with v=spf1, followed by mechanisms that are checked from left to right. The first mechanism that matches the sending IP decides the result. Each mechanism can carry a qualifier: + pass (the default), - fail, ~ soft fail or ? neutral.
| Term | Matches when… | DNS lookups |
|---|---|---|
ip4:203.0.113.5 / ip4:203.0.113.0/24 | The sender's IPv4 address equals the address or is inside the range | 0 |
ip6:2001:db8::/32 | The sender's IPv6 address is inside the range | 0 |
a / a:host.example.com | The sender's IP is one of the A/AAAA addresses of the domain (or the named host) | 1 |
mx / mx:example.com | The sender's IP is one of the domain's MX servers | 1 (plus up to 10 address lookups for the MX hosts) |
include:_spf.google.com | The SPF record of the included domain returns pass | 1, plus every lookup inside that record |
exists:%{i}.bl.example.com | An A record exists for the (usually macro-built) name | 1 |
ptr | Reverse DNS of the sender ends in the domain. Deprecated by RFC 7208: do not use | 1 or more |
redirect=example.com | Modifier: if nothing matched, use another domain's SPF record instead | 1 |
-all / ~all / ?all | Always matches; put it last as the default answer | 0 |
Staying under the 10-lookup limit
RFC 7208 caps an SPF evaluation at 10 DNS-querying terms, counted across the whole tree of includes, and at 2 "void" lookups that return no answer. A typical small business with Google Workspace, a newsletter tool and a help desk stays well under the limit, but every extra marketing or CRM service adds its own nested lookups. If you get close:
- Remove includes for services you no longer use. Old providers are the most common cause of permerror.
- Replace
aandmxwith explicitip4:/ip6:ranges when your server addresses rarely change. - Send bulk or marketing mail from a subdomain (for example news.example.com) with its own SPF record. The limit applies per domain checked.
- Avoid "flattening" services that copy a provider's IPs into your record unless they update it automatically: providers change their ranges without notice.
SPF, DKIM and DMARC together
SPF authorises servers for the envelope sender (Return-Path); DKIM adds a cryptographic signature tied to a domain; DMARC tells receivers what to do when the visible From domain is not aligned with a passing SPF or DKIM result. After publishing SPF, set up DKIM in each sending service and then publish a DMARC policy with the DMARC Record Generator, starting at p=none to collect reports.
Frequently asked questions
What is an SPF record?
SPF (Sender Policy Framework, RFC 7208) is a TXT record on your domain that lists the servers allowed to send email using your domain in the envelope sender (Return-Path). Receiving servers check the sending IP against it and record pass, fail, softfail or neutral.
Can a domain have two SPF records?
No. A domain must publish exactly one TXT record that starts with v=spf1. If there are two, receivers return a permerror and SPF fails for every message. Merge all services into one record instead.
What is the 10 DNS lookup limit?
An SPF check may trigger at most 10 DNS lookups. The mechanisms include, a, mx, ptr and exists and the redirect modifier each count as one, and lookups inside included records count too. Going over the limit makes SPF return permerror. ip4, ip6 and all do not count.
Should I use ~all or -all?
~all (soft fail) asks receivers to accept but mark mail from unlisted servers, which is safer while you are still finding all your senders. -all (hard fail) says unlisted servers are not allowed. With DMARC in place, most receivers rely on the DMARC policy, so either works once all senders are listed.
Is SPF enough to stop spoofing?
No. SPF only checks the hidden envelope sender, not the From address people see. Add DKIM signing and a DMARC record so that receivers can verify the visible From domain and act on failures.
How long until a new SPF record works?
As soon as resolvers pick it up. A new record is usually visible within minutes; if you replaced an old record, allow up to the old record's TTL (often 1 hour) for caches to expire.
What is the maximum length of an SPF record?
Each string inside a TXT record can hold at most 255 characters, but one record may contain several strings that are joined without spaces. Keep the full DNS response under 512 bytes where possible; this tool splits long records into quoted strings automatically.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.