SPF Record Generator
Build a valid SPF record in your browser: toggle mx and a, add IP ranges and third-party includes, choose your policy, and watch the RFC 7208 lookup and length limits live.
1. Who may send mail for your domain?
2. Additional sending IPs
3. Third-party senders
Each include costs one of your 10 permitted DNS lookups.
4. What to do with everyone else
Your SPF record
Publish this as a TXT record on your domain apex. One SPF record per domain - never two.
v=spf1 mx -allAbout SPF Record Generator
The SPF Record Generator builds a syntactically valid SPF record from a description of who actually sends your mail. Tick mx to authorise the hosts in your MX records, tick a for the domain's own address, add any further IPv4 or IPv6 ranges, add the third-party senders you use, then choose what receivers should do with everything else. The record is assembled as you go and shown ready to paste into a TXT record at your domain apex. It runs entirely in the browser; nothing is sent to a server.
RFC 7208 imposes two limits that quietly break hand-written records. The first is ten DNS-querying mechanisms per evaluation: mx, a, include and the rest each cost one, and every include also drags in whatever the provider nests inside it, so crossing ten makes receivers return permerror and treat your domain as having no usable SPF. The second is the 255-character ceiling on a single character string in a TXT record, beyond which the value has to be split into several strings. Publishing two SPF records is also a permerror.
Both limits appear as live counters that turn red the moment you cross them, so an over-long include list is obvious before you publish rather than after mail starts failing. The presets cover the senders European teams actually use, from Google Workspace and Microsoft 365 to Infomaniak, OVH, Scaleway, Mailjet, Brevo, Amazon SES, Mailgun and SendGrid, and any other include domain can be typed in. The policy selector spells out what -all, ~all and ?all mean to a receiver, since that qualifier is where most deployments stall.
How to use it
- 1In step 1, tick mx if the hosts in your MX records send mail, and a if the domain's own address does.
- 2In step 2, add any additional sending IPv4 or IPv6 addresses or CIDR ranges.
- 3In step 3, click the presets for the providers you use, or type a custom include domain.
- 4In step 4, choose the policy: -all to have receivers reject unlisted senders, ~all to softfail while you are still testing.
- 5Check the DNS lookups and length counters stay within 10 and 255 before you publish.
- 6Copy the record and publish it as a single TXT record at your domain apex.
Common use cases
- -Building a first SPF record for a domain that has never published one.
- -Adding a new transactional email provider without breaching the ten-lookup limit.
- -Auditing an existing record by rebuilding it from your real senders and comparing the two.
- -Planning a move from ~all to -all once every sending source has been enumerated.
- -Documenting for a client exactly which mechanism authorises which sender.
Frequently asked questions
- How many DNS lookups is an SPF record allowed?
- Ten. RFC 7208 caps DNS-querying mechanisms, include, a, mx, ptr, exists and the redirect modifier, at ten per evaluation, counting the lookups performed inside any included record as well. Exceeding the limit makes receivers return permerror, which most treat as no SPF at all, so an oversized record is worse than a smaller, accurate one.
- Should an SPF record end in -all or ~all?
- -all once you are confident every legitimate source is listed: it tells receivers to reject mail from anywhere else, and it is what makes DMARC enforcement meaningful. ~all, softfail, is the right setting while you are still discovering senders, because messages are accepted but marked. ?all is neutral, offers no protection, and should be read as unfinished configuration.
- Can a domain have two SPF records?
- No. RFC 7208 requires exactly one record beginning with v=spf1; two of them is a permerror and receivers stop evaluating SPF for the domain entirely. When you add a provider, merge its include into the existing record instead of publishing a second one. Splitting one long record into several quoted strings inside a single TXT record is a different thing, and is permitted.
- What happens if an SPF record is longer than 255 characters?
- A single character string inside a TXT record cannot exceed 255 bytes, so a longer record must be published as several strings, which receivers concatenate without separators. Many DNS providers do this for you when you paste a long value, but not all of them. Approaching the limit is usually a sign to consolidate includes rather than to keep extending the record.