SPF record generator
Tick the services that send email for your domain and get one valid SPF record, with a running count of DNS lookups against the limit of 10.
Before you publish
- Replace your existing SPF record. Never add a second one.
- Prefer DKIM for marketing and CRM tools: DMARC passes if either SPF or DKIM passes with alignment, and DKIM survives forwarding.
- Count the published record with the SPF lookup counter. Why the 10-lookup limit matters.
Frequently asked questions
Can a domain have two SPF records?
No. A domain must have exactly one TXT record starting with v=spf1. Two records make SPF fail for every message, so add new senders to the existing record.
Should I end SPF with ~all or -all?
With an enforced DMARC policy, ~all is a sound default because DMARC makes the final decision. A domain that never sends email should use v=spf1 -all.
How many includes can SPF have?
Evaluating the record may take at most 10 DNS lookups, counted recursively through every include. Over 10 and SPF returns a permanent error.
Related guides
SPF too many DNS lookups
The SPF 10-lookup limit: why adding one more email tool breaks itWhy SPF silently fails after a few include: entries, how to count lookups, and how to fix it without breaking mail.
SPF softfail vs hardfail
SPF ~all vs -all: softfail, hardfail and what DMARC changesWhat each SPF ending tells receivers, how DMARC changes the decision, and a simple rule for active and parked domains.
Guide
SPF, DKIM and DMARC explained: the complete guide for MSPsHow the three email authentication records fit together, with real examples, alignment explained and a rollout plan that does not break mail.