SPF Record Generator

What this generator builds

The generator assembles one SPF record from your choices: v=spf1, then an include: term for each provider you tick, each custom include you add, and each IP address you enter, then the all mechanism you select. Addresses containing a colon become ip6:, everything else becomes ip4:. The output is a TXT value you publish at the root of your domain (host @).

It builds a new record from scratch and does not read your existing DNS. If you already have an SPF record, copy its mechanisms into the generator before publishing, otherwise you will drop senders that currently work.

How to use it

1. List every service that sends email as your domain, not just your mailbox provider: marketing platform, CRM, invoicing, helpdesk, website form plugin, monitoring alerts.
2. Tick the providers you use. For anything not listed, add the include domain from that provider's own SPF documentation under Custom Includes.
3. Add any servers you run yourself as ip4 or ip6 addresses or CIDR ranges, for example 203.0.113.0/24.
4. Choose the enforcement level. Use ~all while you are still confirming the sender list, then -all once you are sure.
5. Copy the record and publish it as a single TXT record at @. If a v=spf1 record already exists, replace it. Never add a second one.
6. Wait for the TTL to expire, then verify the result with the SPF checker.

Choosing the all mechanism

Once DMARC is in place, receivers generally act on your DMARC policy rather than on SPF's own fail or softfail result, so the practical difference between -all and ~all is smaller than it used to be. -all remains the clearest statement of intent.

Provider notes

These are the include values the generator uses for its built-in providers. Confirm them against the provider's current documentation before publishing, because providers occasionally change them.

The 10-lookup limit and what the counter shows

RFC 7208 allows at most 10 DNS-querying terms (include, a, mx, ptr, exists, redirect) in one evaluation, counting those inside every included record. Going over causes a permanent error and SPF fails for every message.

The counter under the provider buttons is deliberately simple: it counts only the providers you tick plus your custom includes. It does not look inside those records, so the real total is higher. Treat the counter as a lower bound, publish the record, then run the SPF checker, which expands each include and reports the actual total.

Best practices

• Publish exactly one SPF record per domain. Two records produce a permanent error.
• Add only services that send as your domain. Each unnecessary include spends part of a ten-lookup budget.
• Prefer ip4 and ip6 for servers you control, since they cost no lookups.
• Send high-volume or third-party mail from a subdomain such as mail.yourdomain.com with its own SPF record, which keeps the root record small.
• Keep the record in a single TXT entry. If it exceeds 255 characters, your DNS provider splits the value into several quoted strings, which receivers join back together. That is valid, but check the result renders as one record.
• Re-run the checker whenever you add or remove a sending service.

Limitations of this generator

• It only produces include, ip4, ip6 and all terms. It does not generate a, mx, exists, redirect or exp mechanisms.
• It does not validate IP addresses, CIDR ranges or custom include domains, so a typo is copied straight into the record.
• The provider list is fixed at eight services. Custom includes cover everything else, but sourcing the correct value is your responsibility.
• It cannot know which services your organisation actually uses. A missing include means that provider's mail will fail SPF.
• SPF alone does not protect a domain. Pair it with DKIM and DMARC.

Related tools and guides