SPF Record
Generator
Create an SPF DNS record for your domain to prevent email spoofing and improve deliverability. Pick your email providers, add your own sending servers, and watch the DNS lookup count as you build the record.
Your SPF Record
This record is longer than 255 characters. Most DNS providers need it split into several strings. Use the DNS record splitter to format it.
How to Add This Record
- 1 Log in to your DNS provider or domain registrar
- 2 Navigate to DNS settings for your domain
- 3 Add a new TXT record with host @ (or leave blank)
- 4 Paste the SPF record above as the value
- 5 Save and wait for DNS propagation (up to 48 hours)
Understanding SPF Records and Their Importance
What is an SPF Record?
SPF (Sender Policy Framework) records are DNS TXT records that specify which mail servers are authorized to send emails on behalf of your domain. By defining these authorized servers, SPF records help prevent email spoofing, where attackers send emails that appear to come from your domain, and significantly improve the deliverability of your legitimate emails.
How to Configure SPF Records
Identify Authorized Mail Servers
Determine which mail servers can send emails for your domain, including your primary mail server, backup servers, and third-party services like Google Workspace, Microsoft 365, or marketing platforms.
Create Your SPF Record
Use our SPF Record Generator above to build your record. Include the necessary IP addresses, enable A and MX records if needed, and add any third-party service domains.
Add the SPF Record to Your DNS
Log in to your DNS provider's management console and add the generated SPF record as a TXT record for your domain. Use "@" or leave the host field blank.
SPF Mechanism Reference
a Authorize your domain's A record IP address
mx Authorize your domain's MX record servers
ip4:address Authorize a specific IPv4 address or range
ip6:address Authorize a specific IPv6 address or range
include:domain Include another domain's SPF record
-all / ~all Fail or SoftFail unauthorized senders
SPF Record Examples
Common records you can copy and adapt. Replace the example IP address with your own.
Google Workspace only
Authorizes Google's mail servers and soft-fails everything else. This is the record Google documents for Workspace domains. It uses 1 DNS lookup plus any lookups inside Google's record.
Microsoft 365 only
Authorizes Exchange Online and hard-fails everything else. This is the record Microsoft documents for Microsoft 365 domains. Switch to ~all if other services still send for the domain.
Google Workspace plus a self-hosted sending server
Staff mail goes through Google. Marketing mail goes out from your own server at 203.0.113.10. The ip4 mechanism needs no DNS lookup, so the server costs nothing against the 10 lookup limit.
SPF Rules That Break Records
The 10 DNS Lookup Limit
RFC 7208 allows at most 10 DNS lookups while a receiver evaluates your SPF record. The include, a, mx, ptr and exists mechanisms and the redirect modifier each use one. Every include also pulls in the lookups of the record it points to, so a record with four includes can pass the limit on its own. Past 10, the check returns a permanent error and SPF fails. To stay under it, remove services that no longer send for you, drop ptr, and list your own servers with ip4 and ip6, which use no lookups.
~all vs -all
~all (SoftFail) tells receivers that mail from unlisted servers is probably not authorized. It is usually accepted and marked as suspicious. -all (Fail) says unlisted servers are not authorized, and some receivers reject that mail outright. Start with ~all until you have confirmed every sender, then move to -all if you want the stricter policy. With a DMARC policy of quarantine or reject in place, DMARC controls what happens to failing mail, so ~all is a common choice. Never publish +all, which authorizes every server on the internet.
One SPF Record per Domain
A domain can publish only one TXT record that starts with v=spf1. Two SPF records cause a permanent error, and receivers then treat SPF as failed for all your mail. This often happens when a new service tells you to "add this SPF record" and the old one stays in place. Merge the new include into your existing record instead. Subdomains are separate: mail.example.com can have its own record.
Records Longer Than 255 Characters
A single string inside a DNS TXT record holds at most 255 characters. A longer SPF record must be published as several quoted strings in the same TXT record. Receivers join the strings without adding spaces, so keep the space between mechanisms at the end of one string or the start of the next. The DNS record splitter formats long records for you. A record that long often also exceeds the 10 lookup limit, so check that too.
SPF for a Self-Hosted Sending Server
If you run your own mail server or MTA, add its public IP addresses with ip4 and ip6 rather than a or mx. This is exact and costs no lookups. SPF checks the envelope sender domain (the Return-Path), so publish the record on the domain your server uses there. Set reverse DNS on each sending IP to a hostname that resolves back to the same IP. For choosing the software and the server, see our guides to self-hosted email marketing software and VPS providers for email marketing.
Frequently asked questions
What is an SPF record?
An SPF record is a DNS TXT record that starts with v=spf1 and lists the servers allowed to send email for a domain. Receiving servers compare the connecting IP address with that list and treat mail from unlisted servers according to the all qualifier at the end of the record.
How many DNS lookups can an SPF record have?
Ten. RFC 7208 limits SPF evaluation to 10 DNS lookups. The include, a, mx, ptr and exists mechanisms and the redirect modifier each count as one, and the lookups inside every included record count too. The ip4, ip6 and all mechanisms do not count. If the limit is exceeded, the check returns a permanent error and the receiver treats SPF as failed.
Should I use ~all or -all?
Use ~all (SoftFail) while you confirm that every service that sends for your domain is in the record. Once you are sure the list is complete, you can switch to -all (Fail). If you publish a DMARC policy, DMARC decides what happens to mail that fails, so many domains keep ~all and enforce through DMARC.
Can a domain have more than one SPF record?
No. A domain must publish exactly one TXT record that starts with v=spf1. If there are two, the SPF check returns a permanent error. To add a new sender, merge its mechanisms into the existing record.
Which address does SPF check?
SPF checks the domain in the envelope sender (the MAIL FROM or Return-Path address), not the From address the reader sees. When an email service uses its own bounce domain, its SPF record covers that domain. DMARC then requires that domain to align with your From domain for SPF to count toward DMARC.
How long does a new SPF record take to work?
Receivers see the new record once their cached copy of the old one expires, which depends on the TTL set on the record. With a short TTL this is minutes. With a long TTL or a slow DNS provider it can take up to 48 hours.
Running Your Own Email Infrastructure
Guides for choosing software and servers when you send from infrastructure you control.
Self-Hosted Email Marketing Software
Eleven self-hosted platforms compared by license, price, sending setup and fit.
VPS for Email Marketing
Port 25 policies, reverse DNS and extra IPs across 14 VPS providers.
Open Source Email Marketing Software
listmonk, Mautic, Keila, phpList and more, with license and last release.
Bulk Email Software
SaaS, self-hosted and desktop senders priced at 400,000 emails a month.
Mailchimp Alternatives
Real prices at 10,000 and 100,000 contacts, including self-hosted options.
Need Enterprise Email Infrastructure?
Octeth provides self-hosted email marketing software with built-in deliverability tools. Own your infrastructure and save on SaaS fees.