SPF Record Generator
Make an SPF record that says which servers may send your mail. Free, no sign-up
What an SPF record does
An SPF record is one TXT record on your domain that lists the servers allowed to send its mail. A receiver compares the server that delivered a message with the list, and treats mail from anywhere else as you tell it to: suspicious with ~all, refused with -all.
List every server and service that sends mail as your domain: your hosting, your mailbox provider, your newsletter service, your shop. A sender you forget will have its mail marked or refused once DMARC is strict.
SPF alone does not stop your address being forged in the From line a person sees. DKIM and DMARC do that, so set all three.
Questions about this tool
Should I use ~all or -all?
Start with ~all, which marks mail from other servers as suspicious without refusing it, while you make sure every sender is listed. Move to -all once you are sure. With DMARC at quarantine or reject, receivers act on DMARC and the difference matters less.
Can I have two SPF records?
No. A domain may have exactly one TXT record that starts with v=spf1. With two, receivers treat SPF as broken and neither counts. Merge them into one, keeping every server from both.
What is the ten-lookup limit?
Receivers stop after ten DNS lookups while reading an SPF record. Every include, a, mx, ptr, exists and redirect costs one, and so do those inside the records you include. Past ten, the record is broken. Addresses (ip4 and ip6) cost nothing.
Do I need a, mx or both?
a allows the server your domain's address points to, usually your website's host; mx allows the servers that receive your mail. Tick each only if that server really sends mail for the domain. If all your mail goes through a service such as Google Workspace, include that service instead.