SPF record generator
Create one SPF record for every service that sends as your domain. Pick your services, add your own servers and choose how the record ends; the generator counts the DNS lookups. It runs in your browser and saves nothing.
Your SPF record
- Type
- TXT
- Name
- @ (the domain itself)
- Value
v=spf1 include:_spf.google.com ~all
Uses 1 of the 10 DNS lookups SPF allows.
include:_spf.google.com1 lookup
Publish it as a TXT record at @ (the domain itself), in place of any SPF record already there.
Create your record in four steps.
Pick your senders
Choose your mailbox provider and every service that sends mail as your domain: newsletters, invoicing, helpdesk.
Add the rest
Type the other includes your services gave you and the addresses of your own mail servers.
Choose the ending
Start with ~all. Move to -all when you know every sender.
Publish and check
Publish the record as one TXT record at the root of your domain, then check it with the SPF checker.
Each service's include costs a different number of lookups.
The generator counts these costs for you. They were measured on live DNS; services change their records, so check the published record with the SPF checker.
| Service | Include | Lookups |
|---|---|---|
| Google Workspace | include:_spf. | 1 lookup |
| Microsoft 365 | include:spf. | 1 lookup |
| Fastmail | include:spf. | 1 lookup |
| Amazon SES | include:amazonses. | 1 lookup |
| Mailchimp | include:servers. | 1 lookup |
| Postmark | include:spf. | 1 lookup |
| Brevo | include:spf. | 1 lookup |
| Zendesk | include:mail. | 1 lookup |
| Zoho Mail (zohomail.com) | include:zohomail. | 2 lookups |
| Zoho Mail (zohomail.eu) | include:zohomail. | 2 lookups |
| Proton Mail | include:_spf. | 2 lookups |
| SendGrid | include:sendgrid. | 2 lookups |
| Salesforce | include:_spf. | 2 lookups |
| Mailgun | include:mailgun. | 5 lookups |
Start with ~all, and move to -all when you know every sender.
With ~all, mail from a server you forgot is marked as suspicious but usually still arrives, and your DMARC reports show it. With -all, receivers may refuse it. Most domains start with ~all and change only after reading their DMARC reports.
Publish one record at the root of your domain.
Add it as a TXT record with the name @ (the domain itself). If a record that starts with v=spf1 is already there, replace it instead of adding a second one: two SPF records break SPF for the whole domain.
Common questions about creating an SPF record
Is the SPF record generator free?
Yes. It runs in your browser, needs no sign-up and saves nothing.
Which services should I include?
Every service that sends mail with your domain in the From address: your mailbox provider, newsletter tool, invoicing or helpdesk software. A service that sends from its own domain does not need to be in your record.
Why is the lookup count higher than the number of includes?
Many services' includes contain further includes, and each one costs a lookup. The table above shows the full cost of each listed service.
Can I add two SPF records, one for each service?
No. A domain can have only one SPF record. Put all services into the same record.
Do I still need DKIM and DMARC?
Yes. SPF alone does not prove that a message came from you. Switch DKIM on in each service and publish a DMARC record; the DMARC record generator writes one for you.