Free SPF record generator
Pick the services that send email for your domain and get an SPF record to paste into your DNS, with an estimate against the 10 DNS lookup limit. Nothing you enter is saved.
Publishing the record
Replace, don’t add. A domain gets one SPF record.
- 01
Find your current record
In your DNS provider, look for a TXT record on the root of your domain that starts with v=spf1.
- 02
Replace or add it
Change that record to the new value, or add a TXT record at @ if there is none. Never keep two.
- 03
Wait for DNS
Changes usually show within an hour. Some providers take up to 48 hours.
- 04
Check the result
Run the free check to confirm the record and see the real lookup count.
Reading an SPF record
What each part means.
- v=spf1
- Marks the TXT record as SPF. It must come first.
- include:
- Allows every server another domain lists in its own SPF record. Each include costs at least one DNS lookup.
- ip4: / ip6:
- Allows a single address or a range. Costs no lookups.
- a / mx
- Allows the servers your domain’s A or MX records point to. One lookup each.
- ~all
- Everything else is marked as suspicious. The usual ending when DMARC is in place.
- -all
- Everything else fails SPF outright. Stricter, and some receivers then reject forwarded email before checking DKIM.
Lookup estimates use each service’s published record as measured in September 2026. Services change their records, so the free check is the final word.
Questions, answered
Before you publish.
Can a domain have more than one SPF record?
No. A domain must publish exactly one SPF record. Two records make SPF fail with an error. If you already have one, add the new services to it instead of creating a second record.
Should the record end with ~all or -all?
~all asks receivers to treat unlisted senders as suspicious; -all asks them to reject. With DMARC in place, the DMARC policy decides what happens to failing email, and ~all avoids some receivers rejecting forwarded email before they check DKIM. Most domains use ~all.
Which parts count toward the 10 lookup limit?
include, a, mx, ptr, exists and redirect each cost one DNS lookup, and so does every include nested inside them. ip4 and ip6 cost nothing. The estimate here uses each service’s published record as measured in September 2026; the free check counts the real total for your domain.
Where do I add the record?
In your DNS provider, as a TXT record on the root of your domain, often shown as @. Replace any existing record that starts with v=spf1 rather than adding a second one.
What if my email service is not listed?
Search the service’s help pages for SPF or domain authentication; they name the include to add. Enter it under other includes. Some services send from their own domain and only need DKIM.
Do I still need DKIM and DMARC?
Yes. SPF checks the server that sent a message, but it breaks when email is forwarded and does not cover the From address people see. DKIM signs the message, and DMARC ties both to your From domain and tells receivers what to do when they fail.
Next step
SPF alone doesn’t protect your From address.
Publish a DMARC record so receivers know what to do with email that fails, and get reports on who sends as your domain.