Skip to content

Free tool

SPF Record Generator

An SPF record is one TXT record on your domain, starting with v=spf1, that lists every server allowed to send your email. Tick the services you use, add your own IPs, and copy a single valid record. The counter keeps you under the limit of 10 DNS lookups.

Already have an SPF record? Import it +

Paste every TXT record that starts with v=spf1. We merge them into one.

Services that send mail as your domain
Using Mailchimp, Postmark, Klaviyo or HubSpot? +
  • Mailchimp (campaigns): SPF is handled on Mailchimp's own sending domains. Set up its DKIM records instead.
  • Postmark: No longer required. Point a custom Return-Path CNAME at Postmark instead.
  • Klaviyo: Usually not needed. Klaviyo's return path passes SPF, and a branded sending domain covers alignment.
  • SparkPost: SPF at the domain apex is not required. The return-path CNAME covers it.
  • Amazon SES (default MAIL FROM): Mail already passes SPF on an amazonses.com subdomain. Use DKIM for alignment.
  • HubSpot: Each account gets its own include, such as 123456.spf03.hubspotemail.net, on the domain setup screen. Paste it into Other includes.
Your own servers

No DNS lookups. Ranges like /24 are fine.

No DNS lookups.

For a service not listed above. Each one costs at least 1 lookup, plus whatever it includes.

Added as written, such as a:host or mx:host. Separate with spaces.

Mail from anywhere else

With DMARC in place, ~all is the common choice: DMARC decides what happens to failing mail. Use -all once you are sure every sender is listed.

Your SPF record

TXT
DNS lookups0 of 10
Host / name
@
Value
v=spf1 ~all

Use @ or leave the host blank for the root domain, depending on your DNS provider. Publish one SPF record per domain.

  • Tick the services that send email for your domain, or add your own IPs, to build the record.

How it works

Build, count, publish

  1. List every sender

    Tick each service that sends mail with your domain in the envelope sender, and add your own servers by IP. Import an existing record to start from it.

  2. Watch the lookup count

    Every include, a and mx costs DNS lookups, and nested includes count too. SPF breaks above 10, so the counter warns you before you publish.

  3. Publish one TXT record

    Copy the value into a single TXT record on your root domain, replacing any older SPF record. Then check it with the deliverability checker.

Using the result

What the lookup count means

  • 7 lookups or fewer

    Comfortable. You have room to add a new service later without breaking SPF.

  • 8 to 10 lookups

    Valid, but one more include could push you over. Remove unused senders now.

  • More than 10 lookups

    Receivers return a permanent error (permerror) and treat SPF as failed for every message. Cut includes before publishing.

Provider counts come from each provider's published SPF record as of October 2026, expanded through every nested include. Providers edit these records without notice, so recheck after you publish. Custom includes are counted as 1, so the total is a minimum.

Before you publish

  • One record only. Two TXT records starting with v=spf1 make SPF fail with a permanent error (RFC 7208, section 3.2).
  • Long records are split. A TXT string holds at most 255 characters. Longer records are published as several quoted strings, which receivers join with no spaces (section 3.3).
  • Keep it short. RFC 7208 suggests keeping the DNS answer under 450 octets so it fits in one UDP packet (section 3.4).
  • SPF alone is not enough. Add DKIM for each service and a DMARC record, which Gmail and Yahoo require for bulk senders.

FAQ

SPF record FAQ

What does an SPF record look like?

An SPF record is a TXT record on your domain that starts with v=spf1, lists the servers allowed to send your mail, and ends with an all rule. For example: v=spf1 include:_spf.google.com ~all lets Google Workspace send for you and soft fails everything else.

Can I have two SPF records?

No. RFC 7208 says a domain with more than one SPF record returns a permanent error, so SPF fails for all your mail. Merge every sender into one record. Use the import box above to paste both records and get a single merged one.

What is the SPF 10 lookup limit?

SPF allows at most 10 mechanisms that need a DNS lookup while checking a message: include, a, mx, ptr, exists and redirect. Lookups inside nested includes count toward the same 10. ip4, ip6 and all do not use lookups.

Should I use ~all or -all?

~all (soft fail) marks unlisted senders as suspicious, while -all (fail) says they are not allowed. With a DMARC policy published, receivers act on DMARC rather than the SPF qualifier, so ~all is a common, lower-risk choice. Use -all only when you are certain the list is complete.

Why does my email service not need an SPF include?

Some services, such as Postmark and Amazon SES by default, send with their own bounce (Return-Path) domain. SPF is checked against that domain, not yours, so an include on your root domain does nothing. For DMARC alignment they rely on DKIM or a custom bounce subdomain instead.

Keep going

Sources

SPF set? Now stop the bounces

Authentication proves your mail is yours. Verifying your list keeps invalid addresses from dragging your reputation down.

Start free Bulk verification

100 free credits · No card required · Credits never expire