SPF record generator
Pick the platforms that send your mail and get one SPF record to paste. Give us the domain as well and we add them to the record it publishes today, so nothing you already have goes missing.
What an SPF record generator gives you
What does an SPF record generator do? It turns a list of the platforms that send your mail into the single TXT record receivers read, with the right syntax, the right ending, and the DNS lookup count that decides whether the record works at all.
SPF is one TXT record on your domain naming the servers allowed to put that domain in the
envelope sender. A receiver compares the connecting IP against the list and applies whatever
the final all mechanism says. The record itself is easy to write. What goes wrong
is everything around it: a second record on the same name, a sender nobody remembered, or one
include too many.
This one merges instead of replacing
Give the page your domain and it reads what you publish today, adds the senders you picked ahead of the ending, and marks the part it added. Every other term stays where it was, in the order it was in, with its qualifier untouched. That matters because the usual way a domain loses a sender is a generated record pasted over the old one: the include for the invoicing platform goes with it, that platform's mail starts failing SPF the moment DNS propagates, and nothing in the new record says what used to be there.
A record this page cannot parse is never edited. It shows you a clean record built from your selections instead, and says plainly that the published one was left alone, because an edit would have to guess at what the rest of the string means.
The ten-lookup budget decides how many senders fit
RFC 7208 gives a receiver ten DNS-querying mechanisms for the whole evaluation:
include, a, mx, ptr, exists
and redirect, counted across everything nested inside every include rather than
just the terms in your own record. Past ten, SPF returns permerror, and a receiver treats a
permerror as no SPF record at all. Every sender in the record loses its SPF pass, not only the
one you added last.
So the count above is run on the merged record, with every include resolved. When it goes over
ten, the page says so before you paste it.
The ten-lookup guide covers winning budget back, and
the SPF checker gives you the same number for a record already
published. Swapping a heavy include for the address ranges it publishes is the usual move: an
ip4: term costs nothing from the budget.
Where the record goes, and how many of them you get
One TXT record, on the domain itself. Not at _spf, not on a subdomain, and never
two: a domain carrying two v=spf1 records is a permerror, and receivers read
neither of them. If you already have a record, the merged version above is what replaces it, in
place, as one edit. Publishing a second record beside it is the mistake this page exists to
stop. The syntax reference covers each mechanism and
what it costs.
SPF is also the weaker half of what makes DMARC pass. It breaks whenever a message is forwarded, because the connecting server is then the forwarder's, and DKIM is what survives that. Publish both, then a DMARC record to find out which of your senders actually pass. The provider pages carry the exact SPF and DKIM records per platform.
The senders this page cannot list for you
A generated record covers the platforms you remember. The reports receivers send name every host that actually sent under your domain, including the one a contractor connected two years ago. On a paid plan, a failing sender that your reports have never named before turns into an email the same day. On Pro, one Monday email covers 10 domains for $19 a month.
Start watching your sendersNo card · 12+ months of history · The free plan does not expire