Skip to content
Emergency helpGet started
Back to Tools

SPF Record Generator

Create an SPF record for your domain. Add the services and servers that send your mail, choose how receivers treat everyone else, and copy a TXT record that follows RFC 7208, with its DNS lookup count.
Build a record
  • Runs in your browser
  • No DNS lookups
Generator

Build your SPF record

Add every service and server that sends mail for the domain. The record updates as you type.

Names the record and links to the checker. Leave it empty to build the record only.

The domain's own servers

One domain per line, as your mail provider documents it. Each include costs at least one DNS lookup.

One per line, such as 192.0.2.10 or 192.0.2.0/24. No DNS lookup.

One per line, such as 2001:db8::1 or 2001:db8::/32. No DNS lookup.

How should receivers treat other servers?
DNS lookups in this record
0/10

Your record

Host
@
Type
TXT
Value
v=spf1 ~all

Checks

Note

~all (softfail) asks receivers to accept mail from unlisted servers but treat it as suspicious. Move to -all once every sender is listed.

Note

No senders are listed, so this record says the domain sends no mail. That suits parked domains; add your mail services if the domain sends email.

Check the published record with the SPF checker

What is an SPF record generator?

An SPF record generator writes the DNS TXT record that lists the servers allowed to send mail for your domain. Choose your senders and a result for everyone else, and the generator writes a record that follows RFC 7208, counts its DNS lookups and flags syntax errors.

It builds the record in your browser and makes no DNS lookups, so it cannot count the lookups inside included records. Publish the result as one TXT record at your domain, then run the SPF checker to confirm what receivers see.

How to publish an SPF record

  1. 1

    List every service that sends as your domain

    Your mailbox provider, marketing and transactional email services, CRM and helpdesk, and any servers that send alerts. Each provider documents the include or IP ranges to use.

  2. 2

    Replace the existing record, don't add a second one

    If the domain already has an SPF record, edit it. Two records starting with v=spf1 cause permerror (RFC 7208, section 3.2).

  3. 3

    Publish it at the domain

    Create a TXT record at the domain itself, often written as @, with the generated value.

  4. 4

    Check it

    Once DNS has propagated, run the SPF checker, then the DMARC checker.

The parts of an SPF record

Mechanisms are evaluated from left to right, and the first one that matches decides the result.
v=spf1
The version. Every SPF record starts with it; TXT records that don't are ignored.
ip4: / ip6:
An IPv4 or IPv6 address or range, such as 192.0.2.0/24. No DNS lookup.
a / mx
The domain's own addresses, or the addresses of its MX hosts. One DNS lookup each.
include:
Checks another domain's SPF record, usually a mail provider's. One lookup, plus the lookups inside that record.
redirect=
Uses another domain's SPF record when nothing else matches. It is ignored when the record has an all mechanism.
-all / ~all / ?all / +all
The result for every other server: fail, softfail, neutral or pass. A mechanism without a qualifier means pass.

Example record

v=spf1 ip4:192.0.2.0/24 include:_spf.example.net -all

Sources

More email authentication tools

Beyond DNS records

These records stop other people sending mail as your exact domain. They do not stop phishing from lookalike domains or from compromised accounts, which send authenticated mail. Vigilbase OS connects the security tools you already pay for, including Microsoft 365, Google Workspace, Proofpoint and Mimecast. The Vigil agent investigates high-severity incidents and Vigilbase analysts handle exceptions.

Managed SOCGet started
Questions

SPF record generator FAQ

How do I create an SPF record?

List the services that send mail as your domain, add each one's include or IP ranges, choose -all or ~all, and publish the result as one TXT record at the domain. This generator writes the record and checks its syntax and DNS lookup count.Email Security AnalyzerCompare the public security checks

Should an SPF record end in -all or ~all?

-all tells receivers that unlisted servers are not authorized; ~all says they probably are not, and receivers should not reject on that alone (RFC 7208, section 8.5). Start with ~all while you confirm every service that sends for you, then move to -all.For DMARC, fail and softfail both count as SPF not passing, so the qualifier matters most for receivers that act on SPF directly.About email authenticationEmail Security Analyzer

How many includes can an SPF record have?

There is no separate limit on includes, but each include, a and mx costs a DNS lookup, and SPF allows 10 lookups in total, including the lookups inside included records (RFC 7208, section 4.6.4).About email authentication

How many DNS lookups does SPF allow?

Ten. include, a, mx, ptr, exists and redirect each count, including the ones inside included records; ip4, ip6 and all do not. Above 10, receivers must return permerror and SPF fails (RFC 7208, section 4.6.4).Remove services you no longer use, or move some senders to a subdomain with its own SPF record. Replacing includes with the provider's ip4 and ip6 ranges also works, but you then have to update the record whenever those ranges change.About email authentication

Can a domain have two SPF records?

No. If a lookup returns more than one TXT record starting with v=spf1, receivers return permerror (RFC 7208, section 4.5). Merge every mechanism into one record and delete the others.About email authentication

What if my SPF record is longer than 255 characters?

One DNS character-string holds 255 characters. Publish the record as several quoted strings in one TXT record; receivers join them without spaces (RFC 7208, section 3.3). The generator shows the split form when you need it.About email authentication

Does the generator look anything up?

No. It builds the record in your browser from what you enter and makes no DNS lookups, so it cannot see the lookups inside included records. Use the SPF checker to see the record receivers get.Email Security Analyzer