Free · live registry data · no login

SPF Record Generator

Build an SPF record for the services you send from.

How it works

SPF record generator: build a correct record for every service you send from

List the email services you use and any dedicated server IPs, choose how strictly unlisted senders should be treated, and we assemble a valid v=spf1 record with the right include for each provider. We also estimate the DNS lookups each include costs so you stay under the limit of 10, and if your domain already has an SPF record we fetch it live and show how the new one compares, so you can merge rather than publish a conflicting second record.

Or start from an example

Results appear here after you click Generate SPF record.

How this works

  1. 1

    Map services to includes

    Each known provider is translated to its official include mechanism; unknown lines are treated as include domains.

  2. 2

    Assemble the record

    IP ranges come first, then includes, then your chosen all qualifier, in valid v=spf1 syntax.

  3. 3

    Compare with live DNS

    We fetch your current SPF record so you can replace it instead of creating a conflicting duplicate.

Frequently asked questions

Can I have two SPF records on one domain?
No. Two v=spf1 TXT records cause a PermError and SPF fails for all mail. If you add a provider, edit the existing record to add its include rather than creating a new record.
Which all qualifier should I choose?
Start with ~all so that mistakes only soft-fail while you confirm every sender is listed. Once DMARC reports show only legitimate sources passing, switch to -all for the strongest policy.
What if my provider is not in the list?
Type its include domain directly, for example include:spf.example-provider.com. Your provider's documentation lists the exact value. Any line that is a valid domain is used as a custom include.
How do I know the real DNS lookup count?
The generator estimates it from known provider behaviour. After publishing, run the SPF Checker, which follows every include recursively against live DNS and reports the exact number.
Does SPF alone stop spoofing?
No. SPF only lets receivers verify the sending server. Attackers can still spoof the visible From address unless DMARC is published, and DKIM is needed so forwarded mail keeps passing.

Every MailShrine domain includes WHOIS privacy, transfer lock, Anycast DNS with DNSSEC and two business mailboxes.

Register a domainSPF, DKIM and DMARC explainedUsing another email provider on your domainMore tools in this category