Free tool
SPF record generator
Build your domain's SPF record from the services that send your mail, with its DNS lookups counted as you go. Enter your domain to start from the record it has now.
Publish this record
- Type
- TXT
- Host
@(your domain itself)- Value
v=spf1 ~all
Counting DNS lookups…
- !Nothing is allowed to send yet. That's right only for a domain that never sends mail; then use -all, and receivers will refuse anything claiming to be from it.
Published it? Check it with the SPF checker →
Sending outreach from this domain? GEOboom finds the pages AI answers cite and runs the outreach to get you mentioned on them, with the mailboxes included.
See how it worksWhat goes in an SPF record
Includes
One include: per service that sends as you, pointing at the list of servers that service keeps up to date. Each costs at least one of your ten lookups.
Your own servers
ip4: and ip6: for servers you run, free of lookups. a and mx only when those servers really send.
The ending
~all or -all, for mail from anywhere not listed. Never +all, which lets the whole internet send as you.
Questions
How do I create an SPF record?
List every service that sends email with your domain in the From address: your mailbox provider, newsletter tool, CRM, helpdesk, invoicing. Each gives you an include hostname in its setup guide. Put them in one TXT record on your domain that starts v=spf1 and ends ~all or -all. Tick the services above, and the record is built for you.
Where do I add the SPF record?
In your DNS host's panel, as a TXT record on the domain itself, usually shown as @ or left blank for the host. A domain can have only one SPF record: if one exists, edit it and add the new include rather than creating a second record, because two records make SPF fail for every message.
How does the generator count DNS lookups?
The way a receiver does: it follows every include in the record you're building, and every include inside those, and counts each include, a, mx, exists and redirect. IP addresses cost nothing. Receivers stop at 10 and treat the record as broken, so the count is shown as you edit, with what each include costs.
Should my record end in ~all or -all?
~all (soft fail) marks mail from unlisted servers as suspicious; -all (fail) asks receivers to reject it. With a DMARC policy at quarantine or reject, ~all protects just as well, because DMARC does the enforcing, and it's more forgiving while you're still finding every service that sends for you. A domain that never sends mail should use v=spf1 -all on its own.
Do I need an include for SendGrid, Mailgun, Postmark or Amazon SES?
Often not. These services send with their own bounce (Return-Path) domain unless you set up a custom one, and SPF is checked against that domain, not yours. An include you don't need still costs lookups. For DMARC, what matters with them is DKIM signed with your own domain, which their domain setup gives you.
What do a and mx mean in an SPF record?
a allows the IP addresses your domain's own name points to, usually the web server. mx allows the servers that receive your mail. Add them only if those servers really send mail as you; each costs a DNS lookup, and on shared hosting they can let other customers' mail pass as yours.