Free SPF Record Generator.

Enter your domain above, choose the services that send email for you, pick a policy and copy the single record the generator produces. If your domain already has an SPF record, we read it and add to it rather than replace it, so existing senders keep working. Publish the result as one TXT record at your domain, replacing the old record, then look it up again to confirm it resolves within the 10-lookup limit.

No. If a name publishes two or more TXT records that start with v=spf1, receivers return a permanent error and SPF fails for all of your mail. This usually happens when someone adds a record for a new service instead of editing the existing one. Combine every sender into a single record and delete the others. When the generator finds more than one record, it merges them into one for you.

It means checking your record needs more than 10 DNS lookups, so receivers stop and treat SPF as failed. The terms include, a, mx, ptr, exists and redirect each count, including every one nested inside an include, while ip4, ip6 and all do not. A separate rule fails the record after more than two lookups that return nothing. The lookup meter and the include tree show where your lookups go.

Flattening replaces an include with the IP addresses it resolves to today. It cuts lookups but freezes a list the provider may change, and mail from any address it adds later starts failing SPF without warning. Try the safer fixes first: remove services that need no entry on your domain, remove senders you no longer use, or move bulk mail to a subdomain with its own record. Microsoft says not to flatten Microsoft 365, so the tool never does.

Use ~all, a soft fail, while you confirm that every real sender passes, then consider -all, a hard fail, once DKIM and DMARC are in place. Google recommends ~all for Google Workspace. Microsoft recommends -all because DMARC can then act on unsigned mail that fails SPF. Both count as an SPF failure under DMARC. Avoid ?all, which asserts nothing, and never use +all, which lets any server on the internet pass.

Google Workspace needs include:_spf.google.com, and Microsoft 365 needs include:spf.protection.outlook.com. Government tenants on GCC High or DoD and tenants operated by 21Vianet use different values, which the generator lists. A domain on only one of them can publish v=spf1 include:_spf.google.com ~all or v=spf1 include:spf.protection.outlook.com -all. If you also send from other services, put every include into that same single record.

Usually not, because these services send with their own return-path domain, so SPF is checked against their domain rather than yours. Postmark says that adding its include to your root record does nothing. Adding includes you do not need only spends your 10 lookups. Authenticate these services with the DKIM records they give you instead, and follow the record a service shows in your account if you use a dedicated IP.

Publish it at your DNS host as a TXT record on the domain you send from, usually entered as host @. Do not put it on a subdomain such as _spf, because receivers look up SPF at the return-path domain itself. If a record starting with v=spf1 already exists, edit that record instead of adding another. A record longer than 255 characters must be split into quoted strings, which the generator does for you.

Use the Check tab to read your live record, see any errors and count its DNS lookups against the limit of 10. To test a specific server, use Test An IP: enter the server's address and your sending address, and we run the same evaluation a receiving server does, showing the result and the term that matched. After you publish a change, allow up to the old record's TTL for every resolver to see it.