Donaldson R F SPF Record Generator
Create the SPF TXT record that lists who is allowed to send email for your domain — with a live count of the 10 DNS lookups SPF allows.
Things to know
Already have an SPF record? Load it here
How SPF works
SPF (Sender Policy Framework) is a DNS record that lists which servers may send email using your domain in the envelope sender. Receiving servers look it up and check whether the connecting server is on the list. The record starts with v=spf1, then mechanisms — mx, a, ip4:, ip6:, include: — and ends with a rule for everyone else: ~all (softfail: probably not allowed), -all (fail: not allowed) or ?all (no opinion). Never end with +all, which allows the whole internet.
Every include, mx, a and redirect costs one DNS lookup, and SPF allows at most 10 in total — counting the lookups inside the records you include — otherwise the record is an error. A domain must have only one SPF record; if you already have one, edit it. SPF alone does not protect your domain: add DKIM signing (check the key with the DKIM record checker) and a DMARC record. Verify the published record, and see the include tree, with the SPF & DMARC checker, and look at your mail servers with MX lookup.
The list of services (Google, Microsoft, SendGrid, Amazon SES, Mailgun, Mailchimp, Postmark, Zoho, Proton) contains the include domains they document at the time of writing; services change them, so confirm in your provider’s help pages.
Frequently asked questions
Which ending should I choose?
Start with ~all. When you are sure every service that sends as your domain is listed (DMARC reports help), switch to -all.
Where do I put the record?
In your DNS provider’s panel, add a TXT record on your domain (name “@” or the domain) with the value shown. Replace an existing SPF record rather than adding a second one.
Does the tool look at my DNS?
No. It builds the record from what you enter; use the SPF & DMARC checker to look up the live record.