SPF Generator
Build a valid SPF record with a guided form.
v=spf1 mx -allQuick answer
This tool builds a valid SPF DNS record from a guided form where you list the servers and services allowed to send mail for your domain. It outputs a ready-to-publish TXT record so receiving servers can verify your mail and reject spoofed senders.
The SPF Generator helps you build a Sender Policy Framework record without memorizing the syntax. SPF is a TXT record you publish in DNS that lists which mail servers are allowed to send email using your domain. Receiving servers check it to decide whether an incoming message is likely legitimate or spoofed. Instead of hand-writing mechanisms like ip4, include and a, you fill in the servers and providers you actually use, choose how strict to be on everything else, and the tool assembles a correctly ordered, syntactically valid record you can paste into your DNS.
How to use it
Start by entering the IP addresses and hostnames your own servers send from, using the ip4, ip6 or a fields. For services like Google Workspace, Microsoft 365 or a marketing platform, add their include value (for example include:_spf.google.com). Then pick an all mechanism: -all rejects everything not listed, ~all marks it as a soft fail. The tool outputs a single string beginning with v=spf1 that you publish as a TXT record at your domain root.
Common problems & fixes
SPF allows at most ten DNS lookups; each include, a, mx and redirect counts, and exceeding the limit causes a permerror that fails validation. Consolidate providers or flatten includes to stay under ten. Publish only one SPF record per domain, since two v=spf1 TXT records is invalid. Avoid the deprecated ptr mechanism, and remember SPF alone does not cover the visible From header, so pair it with DKIM and DMARC for real protection.
Why it matters
Without SPF, anyone can forge your domain in the envelope sender, and receivers have no signal to reject it, which hurts deliverability and invites phishing that borrows your brand. A correct SPF record lets Gmail, Outlook and others verify your sending sources, reducing the chance your legitimate mail lands in spam. It is also a prerequisite for a meaningful DMARC policy, which relies on SPF or DKIM alignment to authorize messages.
Frequently asked questions
- What is the difference between -all and ~all?
- Both apply to servers not listed in your record. -all is a hard fail telling receivers to treat unlisted senders as unauthorized, which is the strongest setting. ~all is a soft fail, suggesting the mail is suspect but should still be accepted, often to spam. Use ~all while testing, then switch to -all once you are confident every sending source is included.
- Where do I publish the record this tool creates?
- Add it as a TXT record in your DNS, at the root of the domain that appears in the envelope from address (the apex, often shown as @). The value is the full string starting with v=spf1. Keep exactly one SPF TXT record per domain. Changes propagate as your TTL expires, so allow some time before testing that senders pass.
- Does this tool query my DNS or send my data anywhere?
- No. The generator runs entirely in your browser and simply formats the values you type into valid SPF syntax. Nothing is looked up, stored or transmitted to a server. Because it does not verify your actual DNS lookup count, check the final record against a live SPF validator to confirm you stay within the ten-lookup limit before going live.