SPF Record Generator

Free SPF Record Generator

Build a valid SPF (Sender Policy Framework) TXT record for your domain by ticking the services that send your email. Combine Google Workspace, Microsoft 365, mail servers and custom IPs into one correct record, with a live DNS-lookup counter so you stay under the limit. Free, no sign-up, runs in your browser.

What an SPF record does

SPF is a DNS record that lists which servers are allowed to send email using your domain. When a receiving server gets a message from you, it checks the SPF record and can reject or flag mail from servers that aren't listed. It's one of the three pillars of email authentication and a prerequisite for DMARC. This tool assembles the record correctly so you don't have to memorise the syntax.

How to use it

Point and click:

• Tick each service that sends email for your domain (Google, Microsoft, your own servers).
• Add any other includes or extra IP addresses.
• Choose your all policy — ~all while testing, -all when confident.
• Publish the value as a single TXT record on your root domain.

The 10-lookup limit

SPF allows a maximum of 10 DNS-lookup mechanisms (each <code>include</code>, <code>a</code>, <code>mx</code>, <code>ptr</code>, <code>exists</code> and <code>redirect</code> counts). Exceed it and your SPF returns a permerror and stops working. This generator counts lookups live and warns you as you approach the limit, so you can swap heavy includes for direct <code>ip4</code>/<code>ip6</code> entries if needed.

Only one SPF record per domain

A domain must have exactly one SPF record. If you use several senders — say Google for mailboxes and a marketing platform for campaigns — you merge them all into a single record rather than publishing two. This tool does that merging for you: tick every sender and it outputs one combined record.

Choosing your all policy

The final <code>all</code> mechanism decides what happens to servers not on your list. <code>~all</code> (softfail) marks unlisted mail as suspicious but still delivers it — the safe choice while you confirm you've listed every sender. <code>-all</code> (fail) tells receivers to reject it, which is the strongest protection once you're sure your list is complete. <code>?all</code> (neutral) does nothing and is rarely useful.

SPF is part of a bigger picture

SPF on its own doesn't fully stop spoofing — pair it with DKIM signing and a DMARC policy. Once your SPF is published, use our DMARC Record Generator to add enforcement and reporting, and our SPF/DKIM/DMARC Checker to verify all three are valid together. Everything here is generated locally in your browser; nothing is uploaded.

FAQ

Related tools

Pro tip: pair this tool with Robots.txt Exposure Checker and Cookie Security Checker for a faster SEO workflow.

• Robots.txt Exposure Checker — Find sensitive paths exposed in robots.txt like admin panels, backups, and databases.
• Cookie Security Checker — Analyze cookies for Secure, HttpOnly, and SameSite flags. GDPR compliance checker.
• XML-RPC Exposure Checker — Check if WordPress XML-RPC is exposed and assess attack surface risks.
• Exposed Admin Path Detector — Detect common admin URLs that may expose login panels or sensitive areas.
• Directory Listing Checker — Detect if directories expose file listings revealing sensitive documents and structure.