SPF Record Generator: Build a Valid SPF DNS Record

An SPF record is a DNS TXT record that lists exactly which mail servers are allowed to send email claiming to be from your domain. It is one of the oldest and simplest email authentication standards, and receiving servers like Gmail and Outlook check it on almost every message they process. Getting it right is a prerequisite for good deliverability, and a broken or missing SPF record is one of the most common reasons legitimate marketing and transactional email lands in spam.

How an SPF record actually works

When a mail server receives a message, it looks up the SPF TXT record for the domain in the message's envelope sender address, then checks whether the server that actually sent the message is listed. Each sending service, such as Google Workspace, Microsoft 365 or a marketing platform like Mailchimp, publishes its own set of servers behind an include: mechanism, which is why this tool lets you add each provider you actually use rather than typing raw IP addresses by hand. Everything else, mx, a, ip4 and ip6, lets you list your own servers directly.

The 10 DNS lookup limit

RFC 7208, the SPF specification, caps a record at 10 DNS lookups per check, counting every include, a, mx, ptr, exists and redirect mechanism, including the lookups nested inside another provider's own included record. Cross that limit and the entire SPF check is required to fail as a permanent error, regardless of whether the actual sender was legitimate. This tool counts lookups as you add senders so you can see how close you are before you publish.

Choosing the right -all qualifier

The final mechanism in an SPF record tells receivers what to do with mail from a source that is not listed. Start a new setup cautiously with ~all, soft fail, which lets mail through while flagging anything unlisted, so you can catch a missed sending source in your logs before it gets blocked. Once you have confirmed every legitimate sender is listed, move to -all, hard fail, which is what stops attackers from spoofing your domain outright.