SPF Record Generator
Build a valid SPF record and see its DNS lookup cost before you publish it.
Pick the services that send mail for your domain, add any servers of your own, and get a valid SPF record ready to publish as a DNS TXT record.
The important part: the generator counts the DNS lookups your record will cost as you build it. Exceeding ten breaks SPF entirely, and it is far easier to catch that here than after mail starts failing.
How it works
An SPF record is a single DNS TXT record on your domain root listing every server permitted to send mail using your domain. Publish it once, and receiving servers consult it on every message.
The record is built from mechanisms:
include:authorises another domain's SPF record — this is how you add Google Workspace, Microsoft 365 or a newsletter provider. Each include costs at least one DNS lookup, and often several, because the included record has includes of its own.ip4:andip6:authorise addresses or ranges directly. These cost no lookups, which makes them the answer when you are near the limit.aauthorises whatever your domain's A record points at — often your web server. One lookup.mxauthorises your incoming mail servers. One lookup, and usually unnecessary: the servers that receive your mail are frequently not the ones that send it.
The record ends with an all mechanism saying what to do with
everything else. Start at ~all (softfail) while you confirm every
legitimate sender is listed, then tighten to -all (hardfail). Never
publish +all — it authorises the entire internet.
Publish the result as a TXT record on your domain root — the host field is
usually @ or blank, not spf. And remember the rule that
catches people out: a domain may have exactly one SPF record.
If one already exists, merge rather than add.
Frequently asked questions
Where do I publish this record?
As a TXT record on your domain root. In most DNS panels the host field is @ or left blank. Do not create a record named "spf" — that is a different, long-deprecated record type and receivers ignore it.
I already have an SPF record. Can I add a second one?
No. A domain may publish exactly one, and two is a permanent error that makes receivers fail SPF entirely. Merge the mechanisms from both into a single record.
Why does the lookup count matter so much?
RFC 7208 caps SPF evaluation at ten DNS-querying terms across the whole recursive tree. Go over and receivers return permerror, which most treat as SPF failing — so your legitimate mail loses authentication. The counts shown here are typical values for each provider.
Should I include "a" and "mx"?
Usually not. Add "a" only if your web server actually sends mail — contact forms and application notifications often do. "mx" authorises your incoming servers, which are frequently not the ones that send. Each costs a lookup you may need elsewhere.
What if my provider is not listed?
Add its include mechanism in the custom includes box — providers publish it in their documentation, usually as something like include:spf.provider.com. You can also paste explicit IP addresses, which cost no lookups.
Should I finish with ~all or -all?
Start with ~all. Once DMARC reports confirm every legitimate sender passes, move to -all. Going straight to -all risks silently rejecting mail from a system you forgot about — invoicing, monitoring, an application server.
Related tools
SPF Checker
Validate your SPF record and count DNS lookups against the 10-lookup limit.
EmailDMARC Generator
Build a DMARC record and know exactly what it will and will not block.
EmailDMARC Checker
Look up and validate your DMARC record, and see what it actually protects.
EmailDKIM Checker
Find and validate your DKIM public key, with automatic selector discovery.
EmailMX Lookup
Find where a domain's email is delivered, with priorities and provider detection.
EmailEmail Header Analyzer
Trace an email's path, time each hop, and read its SPF/DKIM verdicts.
EmailNeed hosting that just works?
Free SSL, daily backups and 24×7 support on every Loudhost plan.