Where do I put the generated record?

Publish it as a single TXT record at your domain root — the host is usually @ (or your bare domain). The value is the whole v=spf1 … string. Changes take a few minutes to a few hours to propagate depending on your DNS provider and TTL.

Can I have more than one SPF record?

No. A domain must have exactly one SPF (v=spf1) record. Two SPF records cause a permerror and SPF fails entirely. If you already publish one, merge the new mechanisms into your existing record instead of adding a second — this tool's output shows all your senders in one line for exactly that reason.

What's the 10 DNS lookup limit everyone warns about?

RFC 7208 caps an SPF record at 10 DNS lookups. Every include:, a, mx, ptr and exists mechanism costs one or more lookups — and includes for big providers expand into several. Google Workspace alone is 4. Go over 10 and receivers return a permerror, which means SPF stops working even though the record looks fine. The lookup meter in the tool counts this for you as you build, so you catch it before you publish.

Should I end with ~all or -all?

Use -all (hard fail) once you're confident your record lists every legitimate sender — it tells receivers to reject anything else, which is the strongest protection. Use ~all (soft fail) while you're still testing, so unlisted mail is flagged but not dropped. Avoid ?all (neutral); it provides almost no protection.

My provider isn't in the list — can I still add it?

Yes. Use the 'Add IP, include or a/mx record' button to add any include: value your provider gives you, raw ip4:/ip6: ranges for your own servers, or bare a / mx to authorise your domain's own hosts. Everything is counted toward the lookup limit automatically.

Does SPF alone stop spoofing?

SPF is one of three pillars. Pair it with DKIM (which signs your mail) and DMARC (which tells receivers what to do when SPF or DKIM fail, and lets you monitor abuse). All three together are what actually lock down your domain and protect deliverability.

§ FREE TOOL / SPF RECORD BUILDER

Build an SPF record that actually works.

Pick who sends email for your domain, add your own servers, choose a policy — and copy a ready-to-publish TXT record. With a live DNS-lookup counter so you never quietly blow past the limit that breaks SPF.

Live 10-lookup check Instant, no waiting No login required Runs in your browser

Who sends email for your domain?

Own servers or other senders (optional)

What happens to everyone else?

Your SPF record

0 / 10 DNS lookups

v=spf1 -all

Add at least one sending source. An SPF record with no senders (v=spf1 -all) rejects all mail claiming to be from your domain.

How to publish this

Add one TXT record at your domain root (host @) with the value above. A domain may have only one SPF record — if you already have a v=spf1 record, merge these mechanisms into it rather than adding a second.

Free tool — nothing you type leaves your browser. Want to check an existing record too? Run the DNS Health Checker.

§ WHY IT MATTERS

A broken SPF record looks exactly like a working one.

DNS lookups is the hard cap SPF must stay under — we count them live

TXT record, one line — exactly what belongs at your domain root

logins, installs, or data sent anywhere — it all runs in your browser

§ HOW IT WORKS

Four choices, one clean record.

Pick your senders

Tick the providers that send mail for you — Google, Microsoft 365, SendGrid, Mailgun and more. Each shows its DNS-lookup cost.

Add your own servers

Drop in raw IP ranges, custom include: values, or bare a / mx mechanisms for hosts you run yourself.

Choose a policy

Pick ~all while testing or -all to reject spoofers outright. We flag the weak ?all option so you don't ship it by accident.

Copy & publish

Copy the finished record and paste it as a single TXT record at your domain root. The lookup meter warns you before you break the 10-lookup limit.

§ THE PRIMER

What SPF is really doing

SPF answers one question for every mailbox provider that receives your mail: is the server sending this message actually allowed to? You answer it by publishing a list of approved senders as a single TXT record. Get it right and receivers trust you; get it wrong — or leave it blank — and your mail slides toward the spam folder while impostors spoof your domain freely.

The trap isn't forgetting the record; it's the 10 DNS-lookup limit. Every include: you add expands into more lookups behind the scenes — Google Workspace alone eats four. Stack a few marketing tools on top of your mailbox provider and you sail past ten without noticing. When that happens, receivers return a permerror and your perfectly reasonable-looking SPF record simply stops working.

This generator counts those lookups live as you add senders, so the moment you get close to the ceiling you see it — and it keeps everything in one record, because a domain is only allowed a single SPF entry. Pick your policy ending, copy the line, and publish.

SPF is one leg of a three-legged stool. Once it's solid, add DKIM and DMARC — and verify your recipient list before each send, so a trusted domain isn't paired with dead addresses and spam traps.

§ FAQ

SPF record FAQ

What SPF does, where to publish it, and how to stay under the lookup limit.

Still have questions? Contact us

SPF (Sender Policy Framework) is a TXT record in your DNS that lists which mail servers are allowed to send email using your domain. When a receiver like Gmail gets a message claiming to be from you, it checks SPF to see if the sending server is on your approved list. Without a valid SPF record, your mail is far more likely to be marked as spam or rejected — and anyone can spoof your domain.

§ PROTECT YOUR DELIVERABILITY

Trusted domain. Clean list.

Set up SPF here, then verify your recipients before you send. Free plan includes 50 verifications a month — no card required.

Start for free

What SPF is really doing

SPF is one leg of a three-legged stool. Once it's solid, add DKIM and DMARC — and verify your recipient list before each send, so a trusted domain isn't paired with dead addresses and spam traps.