SPF Generator
Generate an SPF record from your list of senders.
Build a valid SPF record for your domain by listing the providers and addresses that send your mail. The record updates as you type, and we flag the moment you cross the 10-lookup limit so you know when flattening is needed. Everything runs in your browser. Nothing is sent anywhere.
The SPF Generator builds a valid Sender Policy Framework record from the list of services that send mail for your domain. SPF (RFC 7208) publishes, in DNS, the servers authorised to send on your behalf so receiving servers can verify the sending IP. A correctly built record is the foundation of email authentication and one of the two ways a message can satisfy DMARC alignment.
How to use the generator
Add each genuine sender: your mailbox provider, marketing platform, helpdesk, CRM and any servers that send from your domain. For most cloud providers you should pick their published include: value; for your own servers, add the specific ip4 or ip6 ranges. The tool assembles these after the opening v=spf1 tag and finishes with an all mechanism. Choose -all (hard fail) for enforcement once every sender is listed, or ~all (soft fail) while you are still testing.
Staying within the rules
A working record must respect a few constraints from RFC 7208:
- One record per domain. Publish a single
v=spf1record, never two. - Ten DNS lookups maximum. Each
include,aandmxcosts a lookup; too many causes apermerror. Prefer explicit IP ranges where you can. - No ptr. The
ptrmechanism is deprecated; leave it out.
After generating, publish the record as a TXT entry at your domain root, then confirm it with the SPF Checker to count lookups and verify syntax. SPF alone does not stop spoofing. Pair it with DKIM and a DMARC policy at enforcement. Our done-for-you service keeps these aligned for you, and the requirements page explains how the three records work together.
Frequently asked questions
Where do I publish the generated record?
Add it as a TXT record on your domain's root (the apex, for example example.com), not a subdomain. The value must begin with v=spf1. Subdomains that send mail need their own SPF record.
Should I end with -all or ~all?
Use ~all (soft fail) while you confirm that every legitimate sender is included, then switch to -all (hard fail) for full protection. Avoid +all, which authorises any server to send as you.
How do I keep the record under ten DNS lookups?
Only include senders you actually use, and replace a and mx mechanisms with the explicit ip4/ip6 ranges where practical. Each include and its nested includes count towards the limit of ten.
What if I have several SPF records already?
Merge them. A domain may publish only one v=spf1 record; multiple records cause a permanent error and SPF may be ignored entirely. Combine all mechanisms into the single record this tool produces.
Does an SPF record on its own stop spoofing?
No. SPF authorises sending servers but does not tell receivers to reject forged mail. You need DKIM signing and a DMARC policy of quarantine or reject as well. See how enforcement works.
Why does the generator leave out the ptr mechanism?
Because ptr is deprecated by RFC 7208: it is slow, unreliable and discouraged by mailbox providers. The generator uses include and explicit IP ranges instead.