SPF Record Generator

Build an SPF TXT record for your domain: enter the domain, add your sending sources, and copy the finished record into DNS.

Record settings
Everything stays in your browser; nothing is uploaded or looked up in DNS.

One per row, from your email provider. Each one costs a DNS lookup.

The mx and a mechanisms each cost one DNS lookup.

~all marks failing mail as a soft failure, so receivers may still deliver it. The safe default while you confirm every sender is listed.

Your SPF record
Publish this as a TXT record at the domain root.

Enter a domain to build the record.

How to use

  1. Type the domain you send mail from, for example example.com.
  2. Add one include per line for each email provider you use, plus the IP addresses that send for you. Tick mx or a if your own mail servers send directly.
  3. Pick the all mechanism. Start with ~all (softfail) until you have confirmed that every legitimate sender is listed.
  4. Copy the record and add it as a TXT record at your domain root in your DNS provider's dashboard.

Frequently asked questions

Is my domain or IP list uploaded anywhere?

No. The domain, includes, and IP addresses you enter stay in the browser tab, and the record text is assembled locally as you work. Nothing is sent to a server, nothing is saved on our side or written to your browser's storage, and the tool makes no DNS lookups, so it cannot see your live records. The site sets no cookies and has no accounts; if an ad is shown, the ad network follows its own policies and never receives the sending details you entered.

What does an SPF record do?

Sender Policy Framework (SPF) is a DNS TXT record that lists the mail servers allowed to send email for your domain. When a server receives mail claiming to be from your domain, it looks up the record and checks the sending server's IP against the mechanisms in it. Mail from servers the record does not allow fails the check, which makes it harder to spoof your domain.

What is the 10 DNS lookup limit?

An SPF check may perform at most 10 DNS lookups, per RFC 7208. Each include mechanism costs one lookup, and so do the mx and a mechanisms; ip4 and ip6 values cost none. If a receiver needs more than 10 lookups it returns a permanent error, and many servers then treat your mail as failing. The tool counts the lookups for you as you build.

Should I use ~all or -all?

~all is a softfail: mail that fails the check may still be delivered, it is just flagged as suspicious. -all is a hardfail: receivers are told to reject mail that fails the check. Start with ~all, confirm that all of your legitimate mail passes, then move to -all if you want stricter enforcement.

Where do I publish the record?

Publish it as a TXT record at the domain root, on the domain you send mail from: the host is example.com itself, not a subdomain, and the value is the full record starting with v=spf1. Keep exactly one SPF record at the root; if you need more sending sources, add mechanisms to the existing record instead of creating a second one.

Can this tool check my live DNS?

No. The record is built entirely in your browser and the tool never queries DNS, so it cannot see what is currently published or test whether your mail passes. After you publish the record, check it with dig TXT example.com or your DNS provider's own checker.