SPF Record Generator

About this SPF Record Generator

Build a valid SPF record for your domain: add Google, Microsoft or Zoho, includes, IPs, a, mx, pick hard or soft fail. It is one of the Security and DNS on ToolUstad, and like every tool here it runs entirely in your browser: nothing you type, paste or open is uploaded to a server, and there is no sign-up or usage limit.

What is SPF?

SPF, Sender Policy Framework (RFC 7208), is an email authentication protocol. You publish a DNS TXT record that begins v=spf1 and lists the mechanisms allowed to send for your domain: ip4 and ip6 addresses, a and mx lookups, and include statements that pull in a provider's own record, such as Google Workspace or Microsoft 365. The record ends with an all mechanism that tells receivers what to do with everything else: -all (hard fail) or ~all (soft fail). One record covers your whole domain, so list every sender that uses it before you publish the record.

The mechanisms you will actually use

Why SPF matters now

Since February 2024, Google and Yahoo require bulk senders to publish SPF and DKIM and to have a DMARC record, and enforcement has only tightened since. Without SPF, receivers cannot confirm your mail server is authorised, so messages land in spam or are rejected outright. SPF also stops the simplest form of spoofing, where a stranger sends mail claiming to be your domain from their own server.

Best practices

• One SPF record per domain: two v=spf1 records invalidate both.
• Watch the 10 DNS lookup limit: every include, a, mx and redirect costs lookups.
• Start with ~all while you inventory every sender, then move to -all.
• Include every legitimate sender: website host, helpdesk, CRM and marketing platform.

Common mistakes to avoid

• Publishing SPF as the old SPF record type instead of TXT.
• Forgetting the sending service you use once a quarter, like the invoicing tool.
• Exceeding 10 lookups, which causes a permanent error (permerror) and fails all checks.
• Editing the record and not waiting for DNS propagation before testing.

Who is the SPF generator for?

Domain owners setting up Google Workspace or Microsoft 365, marketers whose newsletters land in spam, and administrators cleaning up deliverability. Writing the record by hand is doable, but one wrong mechanism breaks authentication for the whole domain, while the generator assembles valid syntax and explains each choice as you make it.

A short worked example

A small business using Google Workspace and Mailchimp publishes one record: v=spf1 include:_spf.google.com include:servers.mcsv.net ~all. That single TXT record authorises Google's servers and Mailchimp's servers, soft fails everything else while they monitor, and costs only a handful of the 10 allowed DNS lookups. When a new helpdesk tool starts sending, its include is added to the same record, never as a second one. Build yours in the generator above with your own providers, publish it, then check it resolves with any DNS lookup tool before announcing the change.

Learn: how to use the SPF Record Generator

1. Enter your domain and tick every service that sends email as that domain: Google Workspace, Microsoft 365, Zoho, or your own includes.
2. Add any fixed sending IPs and pick a or mx only if your own servers send mail.
3. Start with ~all (soft fail) while you test, then switch to -all (hard fail) once you are sure every sender is listed.

Features

• One-click includes for Google Workspace, Microsoft 365 and Zoho Mail
• Custom include, ip4 and ip6 lists, plus a and mx mechanisms
• Strict (-all), soft fail (~all) and neutral (?all) endings with guidance
• Ready-to-paste DNS TXT record with host and value
• Per-mechanism explanation and the one-record and 10-lookup warnings

Worked example

Frequently asked questions