SPF Record Generator

The SPF Record Generator builds a valid SPF TXT record by letting you select which email services and IP addresses are allowed to send email from your domain. It also validates whether your record stays within the 10 DNS lookup limit required by the SPF standard.

Tool URL:/tools/spf-generator

What is an SPF record?

SPF (Sender Policy Framework) is a DNS record that lists which mail servers and services are allowed to send email on behalf of your domain. When a receiving server gets an email from your domain, it checks your SPF record to verify the sender is authorized.

Without SPF, anyone can send email claiming to be from your domain. With a valid SPF record, unauthorized senders are more likely to have their email rejected or marked as spam.

How to build your SPF record

Step 1 — Add your email services using presets

The generator shows a row of buttons for popular email services (Google Workspace, Microsoft 365, Mailchimp, SendGrid, and others). Click a button to add that service's SPF include to your record automatically.

For example, clicking Google Workspace adds include:_spf.google.com to your record. This authorizes Google's mail servers to send on your behalf.

You can click multiple presets if you use more than one email service. Each service you add consumes at least one DNS lookup.

Step 2 — Add custom mechanisms manually

If your service is not listed in the presets, or you need to add specific IP addresses, use the Add Mechanism section.

  1. Select the mechanism type from the first dropdown:
    • include — Authorizes a third-party domain's SPF record (e.g. your email provider)
    • ip4 — Authorizes a specific IPv4 address or range (e.g. 192.168.1.10 or 192.168.1.0/24)
    • ip6 — Authorizes a specific IPv6 address or range
    • a — Authorizes the IP addresses in your domain's A record
    • mx — Authorizes your domain's MX (mail exchange) servers
  2. Select the qualifier from the second dropdown:
    • + Pass (default) — This sender is authorized
    • ~ SoftFail — This sender is likely not authorized (email is accepted but marked)
    • - Fail — This sender is not authorized (email is rejected)
    • ? Neutral — No statement about this sender
    In almost all cases you will use + Pass.
  3. Enter the value — the domain or IP address for the mechanism.
  4. Click Add. The mechanism appears in the list below.

Step 3 — Set the default policy (all mechanism)

The Default Policy dropdown controls what happens to senders not covered by any of your mechanisms. This appears at the end of the generated record.

  • ~all (SoftFail) (default) — Unlisted senders are soft-failed. Email is typically accepted but may be marked as spam. Recommended while you are setting up.
  • -all (Fail) — Unlisted senders are rejected. Use this once you are confident your record includes all legitimate senders.
  • +all (Pass) — All senders pass. Never use this — it defeats the purpose of SPF.
  • ?all (Neutral) — No policy for unlisted senders. Rarely used.

Aim to move to -all once you have confirmed all your legitimate senders are included in the record.

Step 4 — Review the generated record

As you add mechanisms, the generated record updates in real time below the form. It will look something like this: 

v=spf1 include:_spf.google.com include:servers.mcsv.net ip4:203.0.113.5 ~all

Click the Copy button to copy the record to your clipboard.

Step 5 — Validate your DNS lookups

Click the Validate DNS Lookups button. The tool sends your record to the DMARC Examiner API, which resolves all includes recursively against real DNS and counts the total number of DNS lookups.

You will see a result showing your lookup count out of the 10-lookup maximum:

  • Green (0–7 lookups) — Your record is within a safe range.
  • Amber (8–9 lookups) — Close to the limit. Consider reducing includes before adding more.
  • Red (10+ lookups) — Your record exceeds the limit. Emails from this domain may be rejected by strict receiving servers.

You will also see the full SPF Include Tree — a visual breakdown showing every include resolved and how many lookups each one contributes. This helps you identify which services are consuming the most lookups.

Step 6 — Add the record to your DNS

Log in to your DNS provider and create a new TXT record:

  1. Create a new TXT record.
  2. Set the Host / Name field to @ (or your root domain, depending on your provider). SPF records go on the root domain, not a subdomain.
  3. Paste the generated record into the Value / Content field.
  4. Save the record.

You can only have one SPF record per domain. If you already have one, edit it in place — do not add a second SPF record, as having two causes SPF to fail.

Step 7 — Verify your record

After the DNS change propagates (usually within a few minutes, up to 48 hours), use the SPF Checker to verify your record is published correctly and all lookups are resolving as expected.

Understanding the 10 DNS lookup limit

The SPF standard (RFC 7208) limits SPF evaluation to 10 DNS lookups. This limit exists to prevent denial-of-service attacks and to keep email delivery fast. The mechanisms that count toward the limit are: include, a, mx, ptr, and exists.

The limit applies recursively. If you include a service's SPF record and that service itself has includes, all of those count toward your limit too.

If you exceed 10 lookups, receiving servers are permitted to reject or ignore your SPF record, which means your emails may be marked as spam even if the senders are legitimate.

To reduce lookups: remove services you no longer use, replace include mechanisms with direct IP ranges where possible, or use an SPF flattening service.

Common questions

Do I need an account to use this tool?

No. The generator is free and requires no signup. The DNS lookup validation uses the DMARC Examiner API anonymously (protected by reCAPTCHA).

I use Google Workspace and Mailchimp. Do I add both presets?

Yes. Click both presets. Each service that sends email on behalf of your domain needs to be included in your SPF record. Validate the lookup count after adding all your services.

What if the tool says my record has too many lookups?

Review the SPF Include Tree shown after validation. Identify which services use the most lookups. Remove any services you no longer actively use for sending. If you are still over the limit, consider contacting your email providers about their lookup optimization options, or use an SPF macro/flattening service.

Can I use this tool to update an existing SPF record?

Yes. Use the SPF Checker to view your current record, then rebuild it in the generator with any changes needed. Replace your existing DNS record with the new one.

Related tools