SPF Generator
Tick the services that send email for your domain and get an SPF record ready to paste into your DNS, with a count of the DNS lookups it uses.
Who sends your email?
Copy these from your provider's setup instructions.
With DMARC in place, ~all and -all are treated much the same. ~all is the safer choice while you check every sender is listed.
Your SPF record
TXT record
0 lookups| Type | TXT |
|---|---|
| Name / host | @ (@ means the domain itself) |
| TTL | 3600, or your DNS host's default |
v=spf1 ~allAfter you publish it
- Replace any existing SPF record. A domain must have only one TXT record starting with
v=spf1. - Wait for the change to spread. Most DNS hosts update within an hour.
- Run the SPF Checker to confirm it is valid and see the full lookup count, including lookups inside each include.
What SPF does
SPF is a list of servers allowed to send email for your domain, published in DNS. Receiving mail servers check it to decide whether a message claiming to be from you came from an approved source. It is one of the three records, with DKIM and DMARC, that Gmail, Outlook and Yahoo look at before trusting your mail.
The 10-lookup limit
Each include, a, mx and redirect makes the receiving server do a DNS lookup, and many includes contain more includes. If the total goes over 10, SPF fails for every message, even ones from approved servers. The count here covers your record only. Providers' own includes add more, so check the published record with the SPF Checker. If you go over, remove services you no longer use first.
Examples
| Setup | Record |
|---|---|
| Google Workspace only | v=spf1 include:_spf.google.com ~all |
| Microsoft 365 plus a newsletter service | v=spf1 include:spf.protection.outlook.com include:sendgrid.net ~all |
| A domain that never sends email | v=spf1 -all |
Limitations
- Provider include values change from time to time. If a provider's setup page gives a different value, use theirs.
- SPF checks the hidden envelope sender, not the From address people see. For that protection you also need DMARC, which the DMARC Generator creates.
- Forwarded mail often fails SPF because the forwarding server is not on your list. DKIM survives forwarding, which is one reason to set it up too.