Back to Tools
📧 Free Tool

SPF Record Generator

Build one valid SPF record from the platforms that send as you. Copy it into DNS. Then check the live domain.

Sending platforms

Toggle the services that actually send. Each include costs one DNS lookup.

IPv4 or IPv6, optional CIDR. These do not count toward the 10 lookup cap.

Extra mechanisms

Leave these off unless those servers send mail. Each one costs a lookup.

Policy

Ready to publish

Generated SPF record

Publish this as a single TXT record at the apex. If a v=spf1 record already exists, merge these terms into it instead of adding a second one.

TXT value

v=spf1 ~all
Type
TXT
Host
@
DNS lookups
0 / 10

Before you publish

  • The record has a policy but no authorised senders. Add include, ip4, or mx terms for the services that actually send.

How to generate an SPF record without breaking mail

An SPF generator is a concatenator with opinions. It should emit one v=spf1 string, refuse +all, and tell you when you are about to blow the 10 lookup cap. It should not pretend it published anything. DNS is still your job.

The usual failure is not syntax. It is two records, or a missing ESP after a platform change, or stacking every SaaS include “just in case” until evaluation returns permerror. This tool builds one record and counts the lookups with the same parser the SPF checker uses.

One record, every sender

Google Workspace, Microsoft 365, Klaviyo, Mailchimp, a dedicated IP: they all go in the same TXT. If a record already exists, you edit it. You do not add another. Two SPF records is a fail even when each one looks fine on its own.

Includes vs IPs

include: is how ESPs authorise themselves. Each one costs a lookup, and nested includes behind Google or Microsoft count later, which this generator does not flatten. Direct ip4 and ip6 terms are free. If you run your own sending IPs, list them that way.

Klaviyo is the awkward one. A branded sending domain usually aligns SPF through a return-path CNAME, so an apex include is not always required. The chip is here because plenty of setups still want _spf.klaviyo.com on the root. Confirm against what Klaviyo is actually showing you.

Start with ~all

-all is the destination, not the onboarding setting. If you hard-fail before every sender is listed, you will reject your own mail and then spend a week deciding SPF is cursed. Generate with ~all, watch DMARC reports, then tighten.

The longer version of how this sits next to DKIM and DMARC is already written: SPF, DKIM, and DMARC.

SPF Generator FAQ

How do I create an SPF record?

List every service that sends mail as your domain, generate one v=spf1 TXT record, and publish it at the apex (@). Do not create a second SPF record if one already exists. Merge the new includes into the existing record, then check it with the SPF checker.

What should I include in my SPF record?

Every platform that is allowed to send: Google Workspace or Microsoft 365 for office mail, plus your ESP (Klaviyo, Mailchimp, SendGrid, and so on), plus any dedicated IPs. If a service is not on the list, its mail can fail SPF. If a service is on the list and you do not use it, you are wasting lookups.

Can I have more than one SPF record?

No. One v=spf1 TXT per hostname. Two records is a permerror, which receivers treat as a fail. Add new senders as extra include or ip4 terms on the same record.

Should I use ~all or -all?

~all is a soft fail and the right starting point while you are still finding senders. -all is a hard fail and the destination once DMARC reports show only legitimate sources. ?all is neutral and barely protects you. This generator will not emit +all.

Do I need the a or mx mechanisms?

Only if those servers actually send mail. a authorises the domain’s A/AAAA addresses. mx authorises whatever your MX records point at. Both cost a DNS lookup. Most people sending through Google, Microsoft, or an ESP do not need them.

Does generating a record publish it?

No. Copy the TXT value into your DNS host at @, wait for propagation, then look the domain up in the SPF checker. The generator only builds the string and counts lookups. It does not touch DNS.

Want the rest of the setup checked?

A generated record is the easy part. A free audit covers authentication, list quality, and the sending habits that actually move inbox placement.

Get Your Free Audit →