Skip to content
Webmaster Tools
EmailSPF Record Generator

SPF Record Generator

Build a valid SPF TXT record.

Services that send mail for you

Each include is the one the provider documents. Amazon SES needs it only on a custom MAIL FROM subdomain, so enter that subdomain above. Postmark and Mailchimp don't need an include: they send from their own bounce domain, which passes SPF for you.

Your own servers

Mail from anywhere else

Your SPF record

Host
TypeTXT
Value
The estimate counts each include, a, mx, ptr, exists and redirect as 1. Lookups inside each included record count too, often several per provider, and SPF fails with a permerror above 10. Check the published record and its real lookup count. Publish only one SPF record per domain: two v=spf1 records are also a permerror.

About the SPF Record Generator

This tool builds a Sender Policy Framework (SPF) record: the v=spf1 TXT record that lists which servers may send mail for your domain. Tick the services you use and it adds the include: each provider documents, such as _spf.google.com for Google Workspace or spf.protection.outlook.com for Microsoft 365. Add your own servers as ip4: and ip6: addresses or CIDR ranges, the domain's a and mx hosts or other includes, then choose what happens to other mail with the all qualifier.

It estimates DNS lookups as you go: each include, a, mx, ptr, exists and redirect costs one, and the lookups inside included records count too; more than 10 is a permanent error under RFC 7208. It warns about +all, ?all and ptr, and when the record passes 255 characters it shows how to split it into several strings in one TXT record.

How to use it

  1. Enter your domain.
  2. Tick each service that sends mail as your domain and add your own servers.
  3. Pick ~all or -all.
  4. Copy the value into a TXT record at @, replacing any existing v=spf1 record.
  5. Check the real lookup count with the email checker.

Examples

Common questions

Should I use -all or ~all?

~all (softfail) is the usual choice with DMARC, which decides the outcome. -all asks receivers to reject outright and is safe once every sender is listed.

Can I have two SPF records?

No. Two v=spf1 records on one name are a permanent error. Merge them into one.

Why doesn't my provider need an include?

Services that send with their own bounce (Return-Path) domain pass SPF on that domain, so an include on yours changes nothing. DKIM then provides DMARC alignment.