SPF Record Generator
Select every service that sends email as your domain, and this builds a correct SPF TXT record, while warning you if it exceeds the 10 DNS lookup limit that breaks SPF entirely.
Tell the world who's allowed to send as your domain.
Without a correct SPF record, anyone can send an email that appears to come from your domain, and the servers receiving that email have no way to tell the difference between your legitimate mail and someone else's forgery. SPF is the DNS record that closes that gap: a published list of exactly which mail servers and services are allowed to send email as your domain, so everything else can be treated as suspicious.
This tool builds that record for you. Check off the services you actually use, Microsoft 365, Google Workspace, your own mail servers by IP, and use the quick-add chips for common marketing, CRM, and helpdesk platforms that also send mail on your behalf, anything sending as your domain needs to be listed, or its mail risks getting flagged or rejected. Already have an SPF record in place? Paste it in first to get it checked for the most common failure: two competing SPF records, which silently breaks authentication for the entire domain, not just the newer one.
The generator also tracks something manual record-building easily misses: SPF allows only 10 DNS lookups total across every include and mechanism you add, exceed that limit and the whole record fails, regardless of how correct it otherwise looks.
Paste what's in your DNS today. We'll flag the common problems, especially multiple SPF records, which silently break email authentication for your whole domain.
We recommend -all. Once you're confident every legitimate sender is listed above, hard fail gives you real protection. Start with ~all only if you're still discovering senders.
Generated record
Copy the record below exactly as generated into a single TXT record, and if you already had an SPF record, replace it, don't add a second one alongside it.
SPF, in plain English.
SPF (Sender Policy Framework) is a DNS record that tells other mail servers which systems are allowed to send email claiming to be from your domain. Without it, or with a broken one, anyone can send an email that appears to come from you, and receiving servers have no way to tell the difference. Publish this as a TXT record at the root of your domain (not a subdomain, unless you're specifically configuring one).
How to add this to your DNS records
DNS records live wherever your domain's DNS is hosted, usually your domain registrar (GoDaddy, Namecheap) or Cloudflare, sometimes your website host. The steps are nearly identical everywhere:
1. Sign in to your DNS provider and open the DNS management page for your domain (often labeled "DNS," "DNS Records," or "Manage Zones").
2. Check for an existing SPF record first. Look through your TXT records for one starting with v=spf1. If one exists, edit it, do not add a second one. Two SPF records break SPF for the entire domain.
3. Add (or edit) a TXT record with these values:
• Type: TXT
• Name / Host: @ (this means the root of your domain; some providers want it blank or your bare domain name instead)
• Value / Content: the record generated above, exactly as shown
• TTL: leave the default (or 1 hour)
4. Save, then verify. DNS changes can take a few minutes to a few hours to propagate. You can verify with a free SPF lookup tool (search "SPF checker"), or from a command line: nslookup -type=txt yourdomain.com, your new record should appear in the results.
Provider notes: In Cloudflare, TXT records have no proxy setting to worry about, just add and save. In GoDaddy, use @ for the Name field. In Microsoft 365 setups where Microsoft manages your DNS, add the record in the Microsoft 365 admin center under Settings → Domains → DNS records instead.
Common mistakes
Publishing more than one SPF record. A domain can only have one SPF TXT record. If you add a second one for a new service instead of editing the existing one, SPF breaks for the whole domain, most receiving servers will treat it as invalid entirely.
Exceeding 10 DNS lookups. Every include, a, mx, and a few other mechanisms count toward a hard limit of 10 DNS lookups per SPF check. Go over that limit and the entire record can fail validation, which is exactly why this tool counts them for you.
Using +all or forgetting to set enforcement. +all tells receiving servers to accept mail from anywhere as valid, it defeats the purpose of SPF entirely. Always end with ~all or -all.
Forgetting third-party senders. Marketing platforms, CRMs, invoicing tools, and helpdesk software often send email "as" your domain. If they're not included in your SPF record, their mail may get flagged or rejected, especially once DMARC enforcement is in place.
Not updating SPF after switching providers. If you move from Google Workspace to Microsoft 365 (or add a new tool), the old include should come out and the new one should go in, stale entries don't help you, and every entry counts against the lookup limit.