Free tool · SPF record generator
SPF Record Generator
Tell us who sends email for your domain and get a valid SPF record to publish — with the DNS-lookup limit checked as you go. Everything runs in your browser.
What an SPF record does
SPF (Sender Policy Framework) is a TXT record on your domain that lists the servers allowed to send email for it. Receiving servers look it up and compare it with the server that delivered each message. Together with DKIM and DMARC, it’s how Gmail, Outlook and Yahoo decide whether mail claiming to be from your domain is genuine.
How to publish your SPF record
- Build the record above and copy it.
- Sign in wherever your domain’s DNS is managed — usually your registrar or DNS host.
- If there’s already a TXT record starting with
v=spf1, edit it rather than adding a new one. Two SPF records make SPF fail for the whole domain. - Otherwise add a TXT record with host
@(or your domain name) and the record as its value. - Wait for DNS to update, then run the SPF checker to confirm it’s live and within the lookup limit.
SPF values for common email providers
| Provider | Include | Provider’s own example ends with |
|---|---|---|
| Google Workspace | include:_spf.google.com | ~all |
| Microsoft 365 | include:spf.protection.outlook.com | -all |
| Zoho Mail | include:zohomail.com | -all (~all also shown) |
| Fastmail | include:spf.messagingengine.com | ?all |
| Proton Mail | include:_spf.protonmail.ch | ~all |
| Namecheap Private Email | include:spf.privateemail.com | ~all |
Providers sometimes show slightly different values inside your account — for example by region or plan. If your provider’s admin panel gives you a specific record, use that.
The 10-lookup limit
SPF allows at most 10 DNS lookups while a receiver evaluates your record (RFC 7208). Every include, a, mx, ptr and exists mechanism counts, as does a redirect= — and so does every lookup inside the records you include. Go over 10 and SPF returns a permanent error, which usually means it fails. ip4 and ip6 entries cost nothing, so listing your own servers by address is the cheapest option.
The counter above shows the lookups your record makes directly. The SPF checker follows every include after you publish and gives the full total.
Questions
Should I use ~all or -all?
Both work. ~all (soft fail) is the common choice alongside DMARC, because DMARC then decides what happens to failing mail. -all (fail) is stricter; use it once you’re sure every service that sends as your domain is listed.
Can I have two SPF records?
No. With more than one SPF record, SPF returns a permanent error. Merge everything into a single record that starts with v=spf1.
Do I need SPF if my domain doesn’t send email?
Yes — publish v=spf1 -all. It tells receivers that no server may send as your domain, which stops spammers using it. Add a DMARC record with p=reject too.
Where do I add the SPF record?
As a TXT record at the root of your domain (host @), wherever your DNS is managed — usually your domain registrar or DNS host, not your email provider.
How long until my SPF record works?
Usually minutes to a few hours, depending on your DNS host and the old record’s TTL. Check it with the SPF checker once it’s published.
Is this generator free and private?
Yes. The record is built in your browser — nothing you enter is sent to our server.
Sources
More free tools
Check something else
Guides