SPF Record Generator
Build a valid SPF TXT record by picking the senders your domain actually uses — no need to memorize the syntax.
Source: RFC 7208 (Sender Policy Framework). See the full methodology page. Reviewed: July 2026.
The 10-lookup limit — the most common SPF failure
RFC 7208 caps SPF evaluation at 10 DNS lookups total across all include, a, mx, exists, and redirect mechanisms in the record, counted recursively through nested includes. Exceed it and receiving mail servers are supposed to treat the entire SPF record as a permanent error — often causing legitimate mail to fail authentication, not just unauthorized senders to pass. Each third-party include: (Google Workspace, SendGrid, Mailgun, etc.) can itself consume several lookups internally, so 3-4 includes can quietly blow the budget. ip4 and ip6 mechanisms don't count toward this limit — prefer them over includes where you have the actual sending IPs.
Only one SPF record per domain
A domain must have exactly one SPF-type TXT record. If you use multiple email providers (say, Google Workspace and a marketing platform), combine them into a single record with multiple include: mechanisms — do not publish two separate v=spf1 TXT records, which most validators treat as a PermError.
Choosing the right qualifier for all
-all (hard fail) tells receiving servers to reject mail from sources not listed — the correct choice once you're confident your record lists every legitimate sender. ~all (soft fail) asks receivers to accept but flag/mark unauthorized mail, useful while testing a new SPF record before committing to hard fail. Avoid +all entirely — it authorizes anyone to send mail as your domain, defeating SPF's purpose.
Already have an SPF record and want to validate it instead of building a new one? Use the SPF Record Checker — it resolves the live record and counts DNS lookups recursively through nested includes.
Does SPF alone stop email spoofing?
Not by itself — SPF only validates the envelope sender's sending IP, not the visible "From" header a recipient sees. Combine SPF with DKIM and a DMARC policy for real protection against spoofing; see the DMARC Record Generator.
Where does the SPF record actually get published?
As a TXT record on the root of your domain (e.g. example.com, not www.example.com). Most DNS providers let you add it directly as a TXT record with host @ or blank.