Log in
Generator

SPF record generator

Build an SPF record step by step – for your own servers, Google Workspace, Microsoft 365 and sending services.

Your own servers
Services you send through
All other servers

How to use the SPF generator

Select every way emails with your sender address are sent – your own server, office suite, newsletter tool, shop, invoicing software. If a sender is missing, its emails fail SPF. You'll find a service's exact include: value in its help pages, usually under “Authenticate domain”.

Important: SPF alone is not enough. For DMARC, SPF must also align with the visible sender address – with sending services, this usually only works via DKIM with your domain. More about alignment

FAQ

How do I create an SPF record?

Choose who sends email for your domain – your own servers, Google Workspace, Microsoft 365, newsletter services. The SPF builder turns this into a ready-made TXT record that you add to the domain at your DNS provider.

Can a domain have multiple SPF records?

No. Each domain may have exactly one TXT record starting with v=spf1. Multiple records make SPF invalid; combine all services in one record.

What is the difference between ~all and -all?

~all (softfail) marks email from unlisted servers as suspicious, -all (fail) has it rejected. Together with DMARC, ~all is usually enough; -all makes sense when you're sure you know all senders.

What happens with more than 10 DNS lookups?

SPF allows at most 10 lookups through include, a, mx, exists and redirect. Beyond that the record counts as broken (permerror). Remove unused services and list your own servers as ip4 or ip6.