SPF Record Generator
Build a valid SPF TXT record for your domain interactively.
About SPF Builder
Builds a valid SPF TXT record for a domain by walking through which mail sources are authorized to send on its behalf — your own mail server, a provider like Google Workspace or Microsoft 365, a transactional email service — and assembling the correct syntax automatically. SPF records are easy to get syntactically wrong by hand, particularly around the include mechanism and the difference between ~all (soft fail) and -all (hard fail). Worth knowing about the 10 DNS-lookup limit SPF imposes — exceeding it causes a permanent SPF failure for the whole domain.
SPF only validates the envelope sender (the technical return-path address), not the visible From address a recipient actually sees — that's specifically what DMARC alignment checks, which is why a domain can pass SPF and still get spoofed in the visible From field without DMARC in place.
DNS Record to Add
Name: @ (your domain)
TTL: 3600
Value: the generated record
Related Tools
How to publish the generated SPF record
- In your DNS provider, create a TXT record on the root of the domain (name
@or blank). - Paste the generated value, starting with
v=spf1. Use TXT — the separate SPF record type (type 99) was deprecated by RFC 7208 and is ignored by receivers. - Wait for the TTL to expire, then confirm it with the SPF, DKIM & DMARC checker.
One record only. A domain must have exactly one SPF record. Two TXT records that both start with v=spf1 cause a permerror, and receivers treat SPF as failed. If you add a new provider, merge its include: into the existing record instead of creating a second one.
Mechanisms and qualifiers
| Part | Meaning |
|---|---|
ip4: / ip6: | Authorize an address or CIDR range directly |
a / mx | Authorize the IPs of the domain's A or MX records |
include: | Authorize everything another domain's SPF allows (e.g. your mail provider) |
-all | Hard fail: reject anything not listed |
~all | Soft fail: accept but mark as suspicious — common while testing |
+all | Authorize the whole internet — never use it |
A common path is to start with ~all, confirm with DMARC aggregate reports that all legitimate sources pass, then switch to -all.
The 10 DNS lookup limit
RFC 7208 limits SPF evaluation to 10 DNS lookups. include, a, mx, ptr, exists and redirect count — including the lookups made inside each included record — while ip4, ip6 and all do not. Exceeding the limit is a permerror. To stay under it, remove providers you no longer use, replace a/mx with explicit ip4 ranges where they are stable, and avoid ptr entirely.
Common questions
Do subdomains inherit SPF? No. Each hostname used in an envelope sender needs its own record.
The domain never sends mail — does it need SPF? Yes: publish v=spf1 -all so nobody can send as it, and pair it with a DMARC p=reject policy.
SPF passes but mail is still spoofed? SPF checks only the envelope sender, not the visible From address. That alignment is what DMARC enforces.