Create a correct SPF record for your domain without memorizing RFC 7208 syntax. List your sending sources, choose how strictly unlisted senders are treated, and copy a ready-to-publish TXT record.
List every server and service allowed to send email as your domain, choose a policy, and get a ready-to-publish TXT record.
Where the record will be published. Optional — leave empty to use the generic host "@".
Delegate this domain's entire SPF policy to another domain's record. A redirect replaces the policy options below and cannot be combined with an all mechanism.
Everything runs in your browser. The values you enter are never sent to a server or stored.
Add the IP addresses or ranges of servers you operate and an include entry for every third-party service that sends mail as your domain. Optionally authorize your domain's A or MX hosts.
Decide what receivers do with senders you did not list: soft fail (~all) while testing, fail (-all) when strict, or a redirect if another domain owns the whole policy.
The record is built deterministically, deduplicated, and checked against the same RFC 7208 parser our checker tools use — including the 10 DNS lookup limit and record length guidance.
Add the value to your DNS provider at the host shown. If an SPF record already exists, merge into it — never publish a second v=spf1 record.
Once DNS propagates, run your domain through the SPF Record Checker to confirm the published record and the true nested lookup count.
Look up a live domain, expand nested includes, and verify the real DNS lookup count of your published record.
Open toolPaste any SPF record text and validate its syntax, mechanisms, and policy without a DNS lookup.
Open toolCreate a DKIM key pair and DNS record so your outgoing mail carries a cryptographic signature.
Open toolBuild a DMARC policy that ties SPF and DKIM to your visible From domain and requests reports.
Open toolAn SPF (Sender Policy Framework) record is a single TXT record published in your domain's DNS that lists which servers and services are allowed to send email as your domain. Receiving mail servers check it to decide how to treat messages from unlisted sources.
Start with ~all (soft fail): unlisted senders are flagged but still delivered, which is forgiving while you confirm your sender list. Move to -all (fail) once you are confident every legitimate sender is included. ?all (neutral) makes no statement and gives you no spoofing protection, so this tool warns whenever you pick it. We never offer +all, because it authorizes every server on the internet.
No. A domain must have exactly one TXT record starting with v=spf1. If one already exists — for example from an email provider setup — merge the new mechanisms into that record instead of adding a second one. Two SPF records cause a permanent error and your policy stops working entirely.
RFC 7208 limits SPF evaluation to 10 DNS-querying mechanisms and modifiers (include, a, mx, ptr, exists, and redirect). Receivers return a permanent error once the limit is exceeded, which can make legitimate mail fail. This generator counts the direct lookups in your record, but included records can spend more — always verify the live total with an SPF checker after publishing.
No. SPF only tells receivers which servers may send as your domain. Inbox placement also depends on DKIM signing, DMARC alignment, sender reputation, and content. Treat SPF as one required layer, not a deliverability guarantee.
The ptr mechanism is deprecated by RFC 7208 (section 5.5) because it is slow and unreliable to evaluate, so this generator deliberately does not offer it. List explicit ip4/ip6 addresses or use include instead.
Automate Sales Outreach & Get Booked!
Start Free Trial(14 Day Free Trial, No CC Required)