Free tool
SPF record generator
Your record
v=spf1 -all
0 of 10 DNS look-ups - Within the limit.
Where does it go?
- Host
- @ (the domain itself)
- Type
- TXT
A domain must have only one SPF record. If you already have a record starting with v=spf1, replace it with this one instead of adding a second.
After publishing: check the recordNext step: create a DMARC record
What is SPF?
SPF is a text record (TXT) in your domain's DNS that tells the world: these are the servers allowed to send mail in my domain's name. When a message from an address in your domain arrives, the receiving server looks up this record and compares the sending server with the list.
If the sender is not on the list, the receiving server does what the end of the record says: -all means "reject", ~all means "accept but mark as suspicious".
SPF, DKIM and DMARC together
SPF checks the server that sent the message. DKIM adds a digital signature to each message that proves it was not changed and comes from your domain. DMARC ties both to the address the reader sees in the From field, says what to do with a message that fails, and sends you reports.
SPF alone is not enough: a forger can put your domain in the From field and pass SPF with another domain. So after SPF, create a DMARC record and turn on DKIM at your mail provider.
Common mistakes
Two or more records starting with v=spf1: this is an error, and servers ignore SPF altogether. When you add a new service, add it to the existing record instead of creating a second one.
+all at the end: it allows every server in the world to send in your name, so the record is useless. That is why the tool does not offer it.
More than 10 DNS look-ups: every include, a and mx needs a look-up, and some services need more inside. Above 10 the receiving server treats the record as an error. The tool counts them for you.
Forgetting a service that sends in your name, such as a billing system or a shop: its messages will fail. Before -all, make sure the list is complete, or start with ~all.
DMARC record generatorCheck your domain's DNS and e-mail
Frequently asked questions
Where do I put the SPF record?
In your domain's DNS, as a TXT record on the host @ (the domain itself). The value is the record you copy from the tool.
I already have an SPF record. Do I add another for the new service?
No. A domain must have one SPF record. Press "Read current record", add the new service, then replace the old record with the new one.
-all or ~all?
-all is recommended once you know everyone who sends in your name. Use ~all for a while during testing, then move to -all.
What if the record needs more than 10 look-ups?
Remove services that no longer send, or move marketing mail to a subdomain with its own SPF record.
The record is longer than 255 characters. What now?
It is written as separate quoted strings, which the server joins. The tool splits it for you, and most DNS panels accept it that way.
Do you keep my domain?
No. The record is built in your browser. The "Read current record" button only asks DNS about the domain, and we keep nothing.