List the sending sources authorized to send email from your domain, generate your SPF record, and publish it on your DNS.
The SPF Generator builds a publish-ready SPF TXT record from your authorized sending sources, failure policy, and optional redirect target.
Use it when setting up email for a new domain, onboarding a new ESP, or rebuilding a record that has grown too complex.
Get a syntactically correct v=spf1 record to paste into your DNS provider.
Add include, ip4, ip6, a, mx, and exists mechanisms with a visual builder.
See estimated DNS lookup count before publishing to avoid the 10-lookup limit.
Soft-fail (~all) recommended by default, safer than hardfail during initial setup.
Provide the domain that will publish the SPF record at its apex.
Configure include (ESP), ip4/ip6, a, mx, or exists mechanisms, or use redirect for delegation.
Select softfail (~all), hardfail (-all), neutral (?all), or pass (+all) as the terminal mechanism.
Copy the record to DNS, then verify with the SPF Checker.
Review the generated record and estimated lookup count before publishing. Warnings highlight potential issues like high lookup counts.
Record generated successfully with no warnings, ready to publish.
Record was generated but warnings were raised, review lookup count or policy choices.
Shows X/10 DNS lookups, stay under 10 to avoid permerror at receivers.
When enabled, the record uses redirect= instead of mechanisms, delegates SPF to another domain.
The full v=spf1 TXT string to publish at your domain apex (@).
Projected lookup count including nested include: chains.
Terminal all mechanism, ~all recommended for new deployments.
Non-blocking notices about lookup limits, policy strength, or mechanism issues.
Use ~all until you confirm all legitimate senders are covered, then consider -all.
Add include: mechanisms for every service that sends mail, Google, Microsoft, SendGrid, etc.
Pass all (+all) authorizes every server on the internet, never use in production.
Use the SPF Checker to confirm the live record matches your generated output.
v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all, authorizes Google and Microsoft to send for your domain.
redirect=domain.com delegates your entire SPF policy to another domain's record, useful for subdomain management.
include: references another domain's SPF record (counts as a lookup). ip4: authorizes a specific IPv4 address directly.
Receivers stop evaluating SPF after 10 DNS lookups. Too many includes cause permerror and SPF failure.
As a TXT record at the domain apex (@ or yourdomain.com), not on a subdomain.
Yes. Copy the output and adjust manually, or regenerate with updated mechanisms in this tool.
exists: is advanced and rarely needed. Most senders only need include, ip4, and the terminal all policy.
The domain you send email from, the record will be published at its root as a TXT record.
Include mechanisms for your email providers (like spf.google.com), plus any IPv4/IPv6 ranges or A/MX references for servers you run.
Soft-fail (~all) is the recommended starting point; tighten to hard-fail (-all) once DMARC reports confirm all legitimate senders are covered.
Copy the generated record and add it as a TXT record at your DNS provider. Then verify it with the SPF Checker after propagation.
Delegates to another domain's SPF record, how you authorize Google Workspace, Microsoft 365, and other email providers.
Authorizes specific IP addresses or CIDR ranges directly, the cheapest mechanisms, since they cost no DNS lookups.
Authorizes the IPs behind your domain's A or MX records. Convenient, but each costs one of your 10 DNS lookups.
The terminal policy: ~all soft-fails unknown senders, -all rejects them, ?all is neutral. Every record should end with one.
At your DNS provider, as a TXT record on the domain root (host @ or blank). Delete any existing v=spf1 record first, a domain must have exactly one.
Start with soft-fail (~all): mail from unauthorized servers is accepted but flagged. Once you've monitored DMARC reports and are confident every legitimate sender is included, move to hard-fail (-all).
redirect=other.domain hands your entire SPF evaluation to another domain's record. Use it when one central record serves many domains, otherwise stick with mechanisms.
Prefer ip4/ip6 mechanisms (they cost nothing), remove vendors you no longer use, and avoid nesting includes. The generator estimates your lookup count as you build.
Strengthen your domain security with our free lookup tools.
SenderSignal monitors these signals continuously: 48 blacklists, SPF, DKIM, DMARC, TLS and more, with alerts in Slack, email and signed webhooks.