SPF Record Generator & Checker
Build a valid SPF record from the services that send your mail, then check what your domain publishes against the RFC 7208 rules.
Build the record on the left, or switch to the checker to read the SPF record a domain publishes right now — every mechanism explained, with the ten-lookup limit counted for you.
Tick every service that sends email using your domain in the From address. Each one adds the include: term it requires, and the DNS lookups it costs.
The final term decides how receivers treat mail from any server not listed above.
- Open the DNS zone of your domain at your registrar or DNS host.
- Delete any existing SPF record — a domain must publish exactly one.
- Add a TXT record on the root of the domain with the value above.
- Wait for the TTL to pass, then confirm it with the checker tab.
- Record type
- TXT
- Name / host
- @ (the root of the domain)
- TTL
- 3600
A domain may publish only one SPF record. To add a new sender, edit the existing record — never add a second one.
| # | Term | Found in |
|---|
| Term | Result | What it does |
|---|
About SPF Record Generator & Checker
The SPF Record Generator & Checker does the two jobs a domain owner actually needs. The generator asks which services send mail using your domain — Google Workspace, Microsoft 365, SendGrid, Mailgun, Amazon SES, your own servers — and assembles a valid `v=spf1` record from them, counting the DNS lookups it will cost as you build. The checker reads the record your domain publishes right now, explains every mechanism in plain language and tests it against RFC 7208.
The rule that catches most people is the ten-lookup limit. Every `include`, `a`, `mx`, `ptr` and `exists` term costs one DNS query, and so does every term inside the records they point at. Go over ten and receivers return a permanent error, which means SPF fails for all of your mail — not just the forged part. The checker follows your includes recursively and shows exactly where each lookup is spent, so you can see which sender pushed you over.
It also flags the failures that quietly undo an SPF record: a second SPF record on the same domain (which makes both invalid), `+all` (which authorises the entire internet), a missing `all` (which asserts nothing), the deprecated `ptr` mechanism, terms placed after `all` where they are never read, and syntax errors that turn the whole record into a permanent error.
How to use SPF Record Generator & Checker
- On the Generator tab, tick every service that sends email using your domain in the From address.
- Add your own mail servers: switch on mx, and paste any fixed IPv4 or IPv6 ranges — IP terms cost no DNS lookup.
- Watch the lookup meter. If it passes ten, drop a sender or replace an include with the IP ranges behind it.
- Choose the final policy: start at ~all (mark as suspicious) and tighten to -all once your DMARC reports are clean.
- Copy the record and publish it as a single TXT record on the root of your domain, replacing any existing SPF record.
- Come back to the Checker tab after the TTL has passed and confirm the published record parses cleanly.