Back to Tools

SPF Record Generator

Generate a valid SPF record for your domain. Select your email providers, add custom IPs, and get a properly formatted TXT record ready to add to your DNS.

About this tool

SPF (Sender Policy Framework) is one of the three pillars of email authentication, along with DKIM and DMARC. It works by publishing a DNS record that lists every server and service authorized to send email on behalf of your domain. When a receiving server gets an email claiming to be from your domain, it checks the SPF record and compares the sending IP against the authorized list. If there is no match, the email fails SPF and may be rejected or flagged as spam.

How SPF records are structured

An SPF record is a TXT record on your domain that starts with "v=spf1" and lists authorized senders using mechanisms like "include:" (for third-party services), "ip4:" (for specific IP addresses), and "a" or "mx" (for your domain's own servers). The record ends with a policy: "~all" (soft fail) or "-all" (hard fail) that tells receivers what to do with unauthorized senders. For example, a typical record might look like: v=spf1 include:_spf.google.com include:sendgrid.net ~all. This generator builds the record for you by letting you pick your providers from a list.

The 10 DNS lookup limit and how to stay under it

SPF has a hard limit of 10 DNS lookups per record. Every "include:" mechanism triggers a lookup, and some services use nested includes that count against your limit. Google Workspace alone uses 3-4 lookups. Add SendGrid, Mailchimp, and a few other services, and you can easily hit the ceiling. If you exceed 10 lookups, SPF validation fails entirely, which is worse than having no SPF record at all. This generator tracks your lookup count as you add services. If you are running into the limit, consider using IP addresses directly (ip4: mechanisms do not count as lookups) or look into SPF flattening services that resolve includes into IP addresses. Verify your final record with our SPF checker to confirm the lookup count.

Common SPF mistakes that break email authentication

The number one mistake is having multiple SPF records on the same domain. You can only have one SPF TXT record. If you have two, both are invalid and all SPF checks will fail. The second most common mistake is forgetting to include a sending service. If you use Google Workspace for employee email and SendGrid for marketing emails, both must be in the same SPF record. Third, many people set "-all" (hard fail) before confirming all legitimate senders are included, which causes their own emails to be rejected. Start with "~all" and monitor with DMARC reports before switching to hard fail.

Completing your email authentication setup

SPF alone is not enough. For full email authentication, you also need DKIM (which cryptographically signs your emails) and DMARC (which tells receivers what to do when SPF or DKIM fails). Generate your SPF record here, then set up DKIM through your email provider, and create a DMARC policy with our DMARC generator. After adding the records to your DNS, use our DNS propagation checker to verify they are live globally before sending any campaigns.

Frequently Asked Questions

How do I create an SPF record?

Select your email sending services from the list (Google Workspace, SendGrid, Amazon SES, etc.), add any custom IP addresses that send email for your domain, and choose your failure policy. The generator builds the complete SPF TXT record that you then add to your domain's DNS. The whole process takes about 2 minutes.

Can I have multiple SPF records on the same domain?

No, absolutely not. Having more than one SPF TXT record on a domain causes all SPF validation to fail, which is worse than having no SPF record at all. You must combine all your sending services into a single record. This is one of the most common email authentication mistakes and this generator prevents it by building one consolidated record.

What is the 10 DNS lookup limit?

The SPF specification limits DNS lookups to 10 per evaluation. Each 'include,' 'a,' 'mx,' and 'redirect' mechanism counts as one lookup, and nested includes within those also count. If your record exceeds 10 lookups, SPF validation returns a permanent error (PermError) and all emails fail the check. The generator displays your current lookup count as you add services.

Should I use ~all or -all?

Start with ~all (soft fail), which marks unauthorized emails as suspicious but still allows delivery. This gives you a safety net while you confirm that all legitimate sending services are included. Once you have monitored DMARC reports for 2-4 weeks and are confident the record is complete, switch to -all (hard fail) for stronger protection against spoofing.

What if I exceed the 10 lookup limit?

You have a few options. First, use ip4: and ip6: mechanisms instead of include: where possible, since IP mechanisms do not count as lookups. Second, consolidate email services if you are using multiple providers for the same purpose. Third, consider an SPF flattening service that resolves all includes into IP addresses automatically and keeps the record updated.

Do subdomains inherit the parent domain's SPF record?

No, SPF records are not inherited by subdomains. If you send email from both example.com and mail.example.com, each domain needs its own SPF record. If a subdomain has no SPF record at all, SPF checks for that subdomain will return 'none,' which means no policy is defined. This is a common oversight when setting up transactional email on a subdomain.

How do I know if my SPF record is working?

After publishing your record, use our SPF checker to validate the syntax and lookup count. Then send a test email to a Gmail or Yahoo account and check the email headers for 'spf=pass.' You can also check the Authentication-Results header using our email header analyzer. If you have DMARC reporting enabled, aggregate reports will show you SPF pass/fail rates over time.

What happens if I forget to add a sending service to my SPF record?

Emails sent from that service will fail SPF authentication. Depending on your DMARC policy, they may be quarantined (sent to spam) or rejected entirely. If you are using ~all (soft fail), the emails will likely still deliver but with a negative authentication signal. Always update your SPF record before enabling a new email sending service.

Compare email marketing software

Hands-on roundups to help you pick the right platform.

More Free Tools

View all tools

SPF Record Checker

Ensure your domain is properly authenticated with our SPF record checker. Avoid spoofing and improve inbox placement.

DKIM Record Checker

Verify your domain's DKIM configuration for email authentication. Check the public key, selector, and key strength to ensure your emails are properly signed.

Email Header Analyzer

Analyze email headers to trace routing, check authentication (SPF, DKIM, DMARC), identify delivery delays, and debug email issues. Paste headers from any email client.

DMARC Record Checker

Check your domain's DMARC policy to protect against email spoofing and phishing. Verify your DMARC record configuration and get recommendations for improvement.

Related reading