🛡️ SPF Record Generator
Build a valid SPF record for your domain. Select your email providers, add custom IPs or includes, and choose your policy.
What Is an SPF Record?
SPF (Sender Policy Framework) is an email-authentication standard that lists which mail servers are allowed to send email for your domain. When a receiving server gets a message claiming to be from you, it looks up your SPF record and checks whether the sending server is on the list. If it isn't, the message can be marked as spam or rejected — which is how SPF helps stop spoofing. The record itself is published as a single DNS TXT record on your domain.
Anatomy of an SPF Record
Every SPF record is one line that starts with v=spf1, lists authorized senders, and ends with an all policy:
v=spf1— the version tag. Every SPF record begins with it.include:_spf.google.com— authorizes another domain's servers (here, Google Workspace). Each provider you use adds one.ip4:/ip6:— authorize a specific IP address or range directly.a/mx— authorize the domain's own A record or its MX (mail) hosts.~all— the catch-all policy at the end: what to do with everything not listed above.
~all vs -all: Which Policy Should You Use?
-all— Hard fail. Mail from any server not listed is rejected. The strongest, correct end state once you're sure every legitimate sender is included.~all— Soft fail. Unlisted mail is accepted but marked suspicious. A safe starting point while you confirm you haven't missed a sender.?all— Neutral. No enforcement at all — offers no spoofing protection and isn't recommended.
Start with ~all, watch your DMARC reports to confirm all real senders pass, then tighten to -all.
Example SPF Records by Provider
Sending through a common provider? Use its include. Combine several by listing each include before the all policy.
| Provider | SPF record |
|---|---|
| Google Workspace | v=spf1 include:_spf.google.com ~all |
| Microsoft 365 | v=spf1 include:spf.protection.outlook.com -all |
| SendGrid | v=spf1 include:sendgrid.net -all |
| Mailchimp | v=spf1 include:servers.mcsv.net ~all |
| Google + SendGrid | v=spf1 include:_spf.google.com include:sendgrid.net ~all |
Remember: a domain may only have one SPF record. Merge every sender into a single record — don't publish two.
include:, a, mx, ptr, exists, and
redirect costs one of SPF's 10 DNS lookups — and nested includes count too. Go
over and receivers return PermError and stop trusting your record entirely. Count yours with the
SPF checker, which shows the full lookup tree.
How to Publish Your SPF Record
- Log in to your DNS provider or domain registrar.
- Add a new TXT record with host/name
@(or leave it blank for the root domain). - Paste the generated record as the value.
- Save, then wait for DNS to update (usually minutes).
- Confirm it's valid with the SPF checker.
Frequently Asked Questions
How do I create an SPF record?
List every service that sends mail for your domain, then combine them into one v=spf1 record ending
in a policy like -all. The generator above builds it for you — select your providers, add any custom
IPs, choose a policy, and publish the result as a TXT record.
What should my SPF record be for Google Workspace or Microsoft 365?
For Google Workspace, use v=spf1 include:_spf.google.com ~all. For Microsoft 365,
use v=spf1 include:spf.protection.outlook.com -all. If you also send through other
services, add each one's include before the all.
How many includes can an SPF record have?
As many as you like, as long as the total DNS lookups stay at or under 10. Each
include (plus any nested ones) counts toward that limit; exceeding it causes a PermError.
If you're near the limit, flatten includes to IPs or remove unused senders.
Can I have two SPF records?
No. A domain must publish exactly one SPF (TXT starting with v=spf1) record. Two records is a
configuration error that causes SPF to fail — merge all senders into a single record instead.