Free email tool
SPF record generator
This SPF record generator builds one correct SPF record for your domain while you type. Tick the mail servers and services that send for you, add other includes or IP addresses, choose what happens to mail from other servers and copy the TXT record with its DNS lookup count.
Free, no account needed
What should my SPF record look like?
An SPF record is one TXT record on your domain that starts with v=spf1, lists every server or service that may send email for you and ends with ~all or -all. If you only send with Microsoft 365, for example, it is v=spf1 include:spf.protection.outlook.com -all. Keep it to one record per domain and within 10 DNS lookups.
What the generator builds
The record starts with v=spf1 and gets a term for every choice you make. The result updates on every change, so you see straight away what each option adds.
- mx: the servers in your MX records may send (1 DNS lookup)
- a: the server your domain points to may send (1 DNS lookup)
- Google Workspace: adds include:_spf.google.com
- Microsoft 365: adds include:spf.protection.outlook.com
- Other senders: one include per line, for example the domain your newsletter or invoicing tool gives you
- IP addresses: added as ip4 or ip6, they use no DNS lookups
- The ending: ~all to have mail from other servers marked as suspicious, or -all to have it refused
How to read the result
The card shows the full record, the host to add it on and how many of the 10 allowed DNS lookups the record uses. It turns red above 10, because receivers then treat the record as broken.
The count covers the terms in your own record. An include can contain more includes of its own, and those count towards the same limit of 10 when a receiver checks your mail. If you are close to 10, run your domain through the SPF and DMARC check after publishing: it reads the live record and reports its lookup count.
Common mistakes
A small typing error breaks the whole record, so copy the result rather than retyping it.
- Adding a second SPF record next to the old one. A domain may only have one, so replace the existing record instead.
- Forgetting a service that sends for you, such as your webshop, booking system or newsletter tool. Its mail then fails SPF.
- Keeping includes for services you stopped using. They cost lookups and still allow those servers to send for you.
- Ending with +all, which lets every server in the world send for your domain.
- Typing include= instead of include:, or adding a space or a trailing dot after the colon.
- Using ptr. The SPF standard says not to publish it; use ip4, ip6 or include instead.
What to do next
Add the record as a TXT record at your DNS provider, on the domain itself. If there is already a record starting with v=spf1, edit that one instead of adding a new one. Changes can take a few hours to show up everywhere.
Start with ~all while you check that all your mail still arrives, and move to -all once you are sure every sender is listed. Then add DKIM through your mail provider and a DMARC record. SPF checks the technical sender address of a message, not the From address your customers see; DMARC is what links the two.
How to use the generator
-
Enter your domain
Type the domain you send email from. The generator uses it to show where the record goes.
-
Choose your senders
Tick the services you use, add other includes and IP addresses one per line, and pick ~all or -all.
-
Copy and publish
Copy the record, add it as a TXT record at your DNS provider and confirm it with the SPF and DMARC check.
Frequently asked questions
Where do I add the SPF record?
As a TXT record on the domain you send from, at the company that manages your DNS. Many DNS panels use @ or an empty host field for the domain itself. A subdomain that sends email needs its own SPF record.
Can I have two SPF records?
No. The SPF standard (RFC 7208) allows only one SPF record per domain. With two, receivers return an error and SPF does not count. Put all your senders in one record.
What do ~all and -all mean?
Both describe mail from servers that are not in your record. ~all is a softfail: receivers accept the message but may mark it. -all is a fail: you ask receivers to refuse it. What a receiver actually does is up to that receiver.
How many includes can I add?
There is no separate limit on includes, but the whole record may use at most 10 DNS lookups and each include uses at least one. ip4 and ip6 entries cost nothing, so a fixed sending address is a good way to save lookups.
Which include do I need for my newsletter or webshop tool?
Each service publishes its own include or IP addresses in its help pages, usually under domain authentication or sender setup. Copy that value into the other senders field.
Does SitePack create the SPF record for me?
For domains managed at SitePack, the SPF record for your SitePack email is created for you. If you add another service that sends in your name, add its include to that same record in the DNS records of your domain.
Related tools and guides
- SPF and DMARC check Check your live SPF record, its lookup count, DMARC and DKIM.
- DMARC generator Create the DMARC record that tells receivers what to do with failing mail.
- Email on your own domain Set up an address like you@yourbusiness.com in three steps.
- Business email at SitePack A 5 GB mailbox with every package, extra mailboxes from €3.25 a month.
- Free tools
Your own domain, email included
A website from €15 a month, billed yearly, with a domain, a 5 GB mailbox and SPF and DKIM set up for you. Try it free for 14 days, no payment details needed.