smtp-test

SPF Record Generator - Create a Valid SPF Record

Choose the services that send email for your domain, add your own servers, and get a ready-to-publish SPF TXT record, with a live DNS lookup count so you stay under the limit.

Services that send email for you
Your own servers
Policy for all other servers

Your SPF record

Type
TXT
Host
@
TTL
3600
Value
v=spf1 include:_spf.google.com ~all

  • 1 top-level DNS lookup

    Includes can add more lookups. Verify the published record with the SPF checker.

Replace any existing v=spf1 record instead of adding a second one.

After publishing, verify it with the SPF checker

How to Publish Your SPF Record

  1. List every service that sends email using your domain: your mailbox provider, transactional email API, marketing platform, CRM, helpdesk and any servers you run.
  2. Select them above, add your own IP ranges, and choose a policy. ~all is the safe default.
  3. In your DNS provider, create (or edit) a TXT record on the root of the domain (@) with the generated value.
  4. Wait for DNS to update, then confirm the record and lookup count with the SPF checker.
  5. Add a DMARC record so receivers know what to do when SPF and DKIM fail.

SPF Includes for Popular Email Providers

IncludeProvider
include:_spf.google.comGoogle Workspace / Gmail
include:spf.protection.outlook.comMicrosoft 365 / Exchange Online
include:amazonses.comAmazon SES (only with a custom MAIL FROM domain)
include:sendgrid.netTwilio SendGrid
include:mailgun.orgMailgun
include:spf.mtasv.netPostmark (custom Return-Path)
include:spf.mandrillapp.comMailchimp Transactional (Mandrill)
include:spf.brevo.comBrevo (formerly Sendinblue)
include:spf.mailjet.comMailjet
include:zoho.comZoho Mail

Providers occasionally change their include. Their own DNS setup page is the authoritative source.

SPF Generator FAQ

Where do I add the SPF record?

In the DNS settings of your domain (registrar, Cloudflare, Route 53, etc.). Create a TXT record with host "@" (the root domain) and paste the generated value. If a TXT record starting with v=spf1 already exists, edit it instead of adding a second one.

How do I combine SPF for Google Workspace and another service?

Put every include in one record, for example: v=spf1 include:_spf.google.com include:sendgrid.net ~all. Never publish one SPF record per provider. Two v=spf1 records make SPF fail with PermError.

Which policy should I choose: ~all or -all?

Start with ~all (SoftFail) while you confirm that every legitimate sender is listed. Once your DMARC reports show no legitimate failures you can move to -all. Use ?all only briefly for testing. It gives no protection.

Do I need to add my newsletter or CRM tool?

Only if it sends with your domain in the envelope sender (Return-Path). Many platforms use their own bounce domain by default and authenticate your mail with DKIM instead. Check the provider's DNS setup instructions. Adding unnecessary includes wastes DNS lookups.

What SPF record should a domain that sends no email use?

Publish v=spf1 -all. It tells receivers no server is allowed to send for that domain, which stops spoofing of parked or unused domains. Pair it with a DMARC record of p=reject.

More Free Email Tools

MX Lookup

Find the mail servers for a domain, their priority, IPs and email provider

SPF Record Checker

Validate an SPF record, count DNS lookups and expand every include

DMARC Record Checker

Look up and explain a domain's DMARC policy, reporting and alignment

DMARC Record Generator

Create a DMARC TXT record with policy, reports and alignment settings

DKIM Record Checker

Check a DKIM selector, read the public key and its length, or scan common selectors

SMTP Test Tool

Open a live SMTP session, test TLS and authentication, and send a test email