SPF record generator

Pick the platforms that send your mail and get one SPF record to paste. Give us the domain as well and we add them to the record it publishes today, so nothing you already have goes missing.

Optional, and the reason to give it: we read the SPF record this domain publishes right now and add your senders to it, rather than handing you a record that would replace it. Leave it empty and you get a clean record built from the boxes you tick.

Who sends mail as your domain?

A platform missing from this list goes in the fold under the button, which also holds your own servers and the ending.

Another sender, your own servers, or a stricter ending

Take the include from the platform's own setup screen, or from our page for it.

Your own mail server or relay, if you run one. These cost no DNS lookup.

How should the record end?

What an SPF record generator gives you

What does an SPF record generator do? It turns a list of the platforms that send your mail into the single TXT record receivers read, with the right syntax, the right ending, and the DNS lookup count that decides whether the record works at all.

SPF is one TXT record on your domain naming the servers allowed to put that domain in the envelope sender. A receiver compares the connecting IP against the list and applies whatever the final all mechanism says. The record itself is easy to write. What goes wrong is everything around it: a second record on the same name, a sender nobody remembered, or one include too many.

This one merges instead of replacing

Give the page your domain and it reads what you publish today, adds the senders you picked ahead of the ending, and marks the part it added. Every other term stays where it was, in the order it was in, with its qualifier untouched. That matters because the usual way a domain loses a sender is a generated record pasted over the old one: the include for the invoicing platform goes with it, that platform's mail starts failing SPF the moment DNS propagates, and nothing in the new record says what used to be there.

A record this page cannot parse is never edited. It shows you a clean record built from your selections instead, and says plainly that the published one was left alone, because an edit would have to guess at what the rest of the string means.

The ten-lookup budget decides how many senders fit

RFC 7208 gives a receiver ten DNS-querying mechanisms for the whole evaluation: include, a, mx, ptr, exists and redirect, counted across everything nested inside every include rather than just the terms in your own record. Past ten, SPF returns permerror, and a receiver treats a permerror as no SPF record at all. Every sender in the record loses its SPF pass, not only the one you added last.

So the count above is run on the merged record, with every include resolved. When it goes over ten, the page says so before you paste it. The ten-lookup guide covers winning budget back, and the SPF checker gives you the same number for a record already published. Swapping a heavy include for the address ranges it publishes is the usual move: an ip4: term costs nothing from the budget.

Where the record goes, and how many of them you get

One TXT record, on the domain itself. Not at _spf, not on a subdomain, and never two: a domain carrying two v=spf1 records is a permerror, and receivers read neither of them. If you already have a record, the merged version above is what replaces it, in place, as one edit. Publishing a second record beside it is the mistake this page exists to stop. The syntax reference covers each mechanism and what it costs.

SPF is also the weaker half of what makes DMARC pass. It breaks whenever a message is forwarded, because the connecting server is then the forwarder's, and DKIM is what survives that. Publish both, then a DMARC record to find out which of your senders actually pass. The provider pages carry the exact SPF and DKIM records per platform.

The senders this page cannot list for you

A generated record covers the platforms you remember. The reports receivers send name every host that actually sent under your domain, including the one a contractor connected two years ago. On a paid plan, a failing sender that your reports have never named before turns into an email the same day. On Pro, one Monday email covers 10 domains for $19 a month.

Start watching your senders

No card · 12+ months of history · The free plan does not expire

The other tools