SPF Record Generator

How do I create an SPF record?

Reviewed by Prabath Thalangama · Last updated October 23, 2026

List every server and service that sends mail for your domain, combine them into one TXT record starting v=spf1, and end it with -all or ~all. This generator builds that record from your IP ranges, provider includes and A/MX choices, and warns about invalid addresses, +all and too many lookups.

The order is fixed: a, mx, ip4, ip6, include, then the all qualifier. Order doesn't change the result of an SPF check, because the first matching mechanism wins and every mechanism here passes.

The lookup count covers the record itself: one each for a, mx and every include. Each include can trigger more lookups inside the provider's own record, so check the published result with the SPF checker and keep a margin under 10.

How do I generate an SPF record?

Tick a and mx if your website or mail servers send mail themselves.
Add your own sending IPs as ip4 or ip6 ranges, and each provider's include, for example _spf.google.com, spf.protection.outlook.com or sendgrid.net.
Choose the all qualifier: ~all while you are finding every sender, -all once you are sure.
Publish the record as a TXT record on the bare domain, replacing any existing v=spf1 record.

How to read the results

Record: The complete v=spf1 TXT value to publish.
Lookups: DNS lookups the record itself needs. Over 10 is a permerror, and receivers then ignore your SPF.
Warnings: Addresses that don't look like IPv4/IPv6 values, more than 10 lookups, and +all, which lets any server pass.

Common SPF record mistakes

Publishing a second SPF record

A domain may have only one v=spf1 record; two cause a permerror. Merge everything into one record.

Using +all or ?all

+all authorises the whole internet and ?all says nothing. Use ~all or -all.

Adding a provider's IPs instead of its include

Providers change their IP ranges. Use the include they document so your record stays current automatically.

v=spf1 ip4:198.51.100.0/24 include:_spf.google.com -all

Examples and command-line equivalents

Google Workspace plus one office server

v=spf1 ip4:203.0.113.25 include:_spf.google.com -all

Microsoft 365 plus SendGrid

v=spf1 include:spf.protection.outlook.com include:sendgrid.net -all

A domain that never sends mail

v=spf1 -all

Frequently asked questions

Where do I add the SPF record?

In your DNS provider, create a TXT record with the host or name set to @ (the bare domain) and paste the generated value. Then verify it with the SPF checker.

Can one SPF record cover several email providers?

Yes, and it must: list every provider's include in a single v=spf1 record. Each include costs at least one of the 10 allowed DNS lookups, so remove providers you no longer use.

Should I end SPF with -all or ~all?

-all (fail) is the stricter statement, but with DMARC in place most receivers act on the DMARC policy rather than the SPF qualifier. ~all is a reasonable choice while you confirm every sender is listed.