Skip to content
inboxprobe

Checkers

Generators

Guides

Generators

SPF record generator

Tick every service that sends mail as your domain. You get one valid record to paste — and a live count of the DNS lookups it really costs.

Who sends email for you?

Tick every service that sends as your domain: mailbox, newsletters, invoices, help desk, CRM.

Mailbox providers
Sending services

One per line, e.g. 203.0.113.10 or 203.0.113.0/24

One per line, e.g. a per-account include from HubSpot.

This domain's own servers
What should happen to mail from anyone else?

Your SPF record

Type
TXT
Host / name
@
Value
v=spf1 include:_spf.google.com ~all

Publish as a TXT record at the root of your domain (host @). Replace any existing v=spf1 record — never add a second one.

    1 direct DNS lookup; includes add their own.

    Step zero: list who sends as you

    Most SPF problems come from a forgotten sender, not a typo. Before you build the record, check the obvious and the not-so-obvious:

    • Your mailbox provider (Google Workspace, Microsoft 365, Zoho…).
    • Marketing email (Mailchimp, Brevo, Klaviyo…). Some don't need an SPF include at all — Mailchimp authenticates with DKIM only.
    • Transactional email from your app or shop (SendGrid, Postmark, Amazon SES, Mailgun).
    • Help desk and CRM (Zendesk, Freshdesk, HubSpot, Salesforce).
    • Your website's contact form, invoicing software, the office printer that emails scans.

    Not sure? Publish DMARC with p=none and rua= first (DMARC generator): within a few days the aggregate reports list every server sending as your domain.

    Rules the generator enforces

    • One record. We output exactly one v=spf1. If you already have one, replace it — don't add a second.
    • 10 DNS lookups maximum, nested includes counted. The live counter fetches each include's current record so you see the real total, not just the number of includes.
    • Valid IPs and ranges. 203.0.113.10, 203.0.113.0/24, 2001:db8::/48. Hostnames go in include: or a:, not ip4:.
    • 255-character strings. Long records must be split into several quoted strings; most DNS panels do it for you, and we show the split if yours doesn't.

    When one record isn't enough

    If you use many services, you'll hit the 10-lookup limit. The clean fix is to send different streams from different subdomains — news.example.com for marketing, billing.example.com for invoices — each with its own SPF record and its own budget. It also keeps a marketing reputation problem away from your staff's mail.

    Questions

    Where do I put the SPF record?

    As a TXT record on the root of your domain. Most DNS panels call the host @ or leave it empty. If you send from a subdomain, that subdomain needs its own record.

    I already have an SPF record. Do I add this one?

    No — replace it. A domain must have exactly one v=spf1 record; two records make SPF fail for every message. Build a single record containing all your senders.

    Why does the live count differ from the number of includes?

    Includes can contain more includes. Google's include alone costs 4 lookups at the time of writing. The live count fetches each provider's current record, the same way receivers do.

    How long until a new SPF record works?

    Usually minutes; at most the TTL of the old record (often an hour). Run the SPF checker afterwards to confirm what the world sees.

    Sources

    Last reviewed: