spf record generator

Overview

SPF (Sender Policy Framework) is a single TXT record at your domain's apex that lists which servers are allowed to send mail as your domain. it starts with v=spf1 and is a sequence of mechanisms — a (your A records), mx (your MX hosts), ip4:/ip6: (literal addresses), include: (another domain's SPF, used for Google/Microsoft/ESPs) — ending in an 'all' qualifier that says what to do with everything else. two things break SPF in practice. first, the qualifier: -all (hardfail) rejects unlisted senders, ~all (softfail) accepts-but-marks them, ?all (neutral) does nothing, and +all authorizes the whole internet — never use +all. second, the 10-DNS-lookup limit: a, mx and every include each cost one DNS lookup, and if the total exceeds 10 the record returns PermError and SPF fails entirely. this generator counts those lookups as you build so you don't blow the limit.

How to use

1. add your senders — tick a/mx if you send from your own servers; add an include: for each ESP.
2. add any static IPs — ip4:/ip6: for fixed sending addresses — these don't count toward the lookup limit.
3. pick a qualifier — -all is recommended once you're sure every sender is listed; ~all while testing.
4. publish one TXT record — at the apex (yourdomain.com). a domain must have exactly one SPF record.

Examples

input
include _spf.google.com · -all

output
v=spf1 include:_spf.google.com -all

input
mx + Google + SendGrid · ~all

output
v=spf1 mx include:_spf.google.com include:sendgrid.net ~all

Common mistakes

• only one SPF record per domain — two v=spf1 TXT records is a PermError and breaks SPF. merge every sender into a single record.
• the 10-lookup limit — a, mx and each include cost a lookup; over 10 total, SPF PermErrors. ip4/ip6 are free — prefer them, or flatten includes.
• never use +all — +all lets anyone send as your domain, which defeats the entire point of SPF.
• SPF alone doesn't stop spoofing — SPF checks the envelope sender, not the visible From:. you need DKIM and DMARC to actually stop From-header spoofing.

FAQ

Related tools

• spf checker — find and parse a domain's SPF (sender policy framework) record.
• dmarc record generator — build a valid DMARC TXT record from your policy, reporting addresses and alignment — with warnings for the mistakes people make.
• dmarc checker — find and parse a domain's DMARC policy record at _dmarc.<domain>.
• mx lookup — list the mail exchangers (MX records) a domain advertises, sorted by priority.

References

1. RFC 7208 — SPF
2. SPF record syntax (dmarcian)