What does an SPF generator do?
An SPF generator assembles the DNS TXT record that lists who may send email for your domain. You choose your mail providers and any server IP addresses, and it writes the mechanisms in the right order with the right syntax, so you publish one valid record instead of hand-editing a string that fails silently.
How to use the record
- Tick every service that sends email using your domain — mailbox provider, marketing tool, helpdesk, invoicing, website forms.
- Add the IP addresses of any mail server you run yourself.
- Choose how strict to be. Start with
~allif you are not sure the list is complete. - Copy the record and add it at your DNS host as a TXT record on the root of the domain (often shown as
@). - Run the SPF checker to confirm it is live and within the lookup limit.
What each part means
| Part | Meaning | DNS lookups |
|---|---|---|
v=spf1 | Marks the record as SPF. Always first. | 0 |
include:domain | Also allow whatever that domain's SPF record allows. Used for hosted providers. | 1 or more |
ip4: / ip6: | Allow one address or a CIDR range. | 0 |
a | Allow the IPs of the domain's own A/AAAA records. | 1 |
mx | Allow the domain's inbound mail servers to send too. | 1 |
~all / -all | What to do with everyone else: softfail or fail. Always last. | 0 |
Receivers stop after 10 DNS lookups (RFC 7208, section 4.6.4). The generator shows what your top-level choices cost, but an include often contains more includes. The checker counts the real total.
Choosing between ~all and -all
-all says mail from any server not listed is unauthorized. ~all says it is probably unauthorized. If you also publish a DMARC policy, receivers treat both as an SPF failure, so the practical difference is small — and ~all is more forgiving when a legitimate sender has been forgotten.
Use -all on domains that send no email at all, and on domains where you are certain the list is complete. A parked domain should publish exactly this:
v=spf1 -allProvider values used by this generator
| Provider | Mechanism |
|---|---|
| Google Workspace | include:_spf.google.com |
| Microsoft 365 | include:spf.protection.outlook.com |
| Amazon SES | include:amazonses.com |
| SendGrid | include:sendgrid.net |
| Mailgun | include:mailgun.org |
| Mailchimp | include:servers.mcsv.net |
| Postmark | include:spf.mtasv.net |
Some services give each account its own include value, and some send from a subdomain they ask you to delegate. If your provider's setup page shows something different from the preset, use theirs and add it as a custom include.
Mistakes to avoid
- Publishing a second record. Adding a new TXT record for each new service is the most common SPF error. There must be exactly one
v=spf1record per domain. - Putting SPF on the wrong name. The record belongs on the domain used in the envelope sender. If a service sends as
bounce.example.com, that subdomain needs the record, not the root. - Including everything just in case. Every include costs lookups and widens who may send as you. List only services that really send mail for the domain.
- Forgetting to remove old providers. A service you left years ago can still send mail that passes your SPF.
Private by design
This generator runs entirely in your browser. Nothing you type — domain names, IP addresses, provider choices — is sent to our servers or stored. The record is built from the form with a few lines of JavaScript.