Free tool · No account needed
SPF Record Generator
SPF tells receiving mail servers which servers may send email for your domain. Tick the services you use, add any servers of your own, and copy the record to publish — it is checked against the lookup limit as you build it.
Your SPF record
0 of 10 lookups- Type
- TXT
- Name
- @ (your domain itself)
Value
v=spf1 ~all- The record authorises no senders yet. Pick the services that send email for the domain, or add their addresses.
About SPF
What the record does
- Receivers compare the server delivering a message with the list in your SPF record. Mail from a server not on the list fails SPF.
- SPF alone does not stop spoofing of the From address people see — DMARC does that, using SPF and DKIM. Publish both.
- Includes change when providers move their servers, which is why the record names them rather than their addresses.
Free tools
More free tools
- DNS LookupCheck any record type on three public resolvers and the domain's own nameserver, and see whether a change has propagated.
- DMARC Record GeneratorChoose a policy and where reports go, and get the DMARC record to publish at _dmarc on your domain.
- Favicon GeneratorTurn an image or a letter into favicon.ico, the PNGs every platform asks for and a web manifest — made in your browser.
Questions
Frequently asked questions
- Where do I publish the SPF record?
- As a TXT record on the domain itself — often written as @ at your DNS provider. Not on a subdomain, and not at _spf.
- I already have an SPF record. Do I add a second one?
- No. A domain must have exactly one SPF record; two make both invalid. Build one record that lists every service, and replace the old one with it.
- What is the 10-lookup limit?
- Receivers stop evaluating SPF after 10 DNS lookups and fail the check. Every include, a and mx costs at least one, and an include can cost more inside the record it points at — so drop services you no longer use.
- Should I end with ~all or -all?
- ~all is the safer start: mail from unlisted servers is marked suspicious rather than refused. With DMARC in place, receivers act on DMARC's policy either way, so -all adds little and risks losing mail from a sender you forgot.