Free tool · Deliverability SPF Record Generator
Build a correct SPF record without reading an RFC. Tick the platforms that send email for your domain, choose a fail policy, and copy a TXT record that's validated against the 10-lookup limit as you build it.
Who sends email for this domain?
Fail policy
DNS lookups used: 0 / 10 (nested includes inside your providers' records count too)
What this generator builds
An SPF record is a single TXT record that lists every server allowed to send email as your domain. Receivers check the connecting IP against that list on every message. The syntax is unforgiving: one duplicate record or one lookup over the limit and receivers ignore your SPF entirely, so the generator enforces the rules that matter as you build.
One record, every sender
The most common SPF mistake is publishing a second record when adding a new tool. The right move is always to merge: one v=spf1 record containing every sender. Select all your platforms above and the generator merges them for you, deduplicated.
Live lookup counting
Each include costs at least one DNS lookup against the hard cap of 10, and the includes nested inside your providers' own records count too. The counter under the form shows your top-level total so you can see headroom before you publish. If you're near the ceiling, prune tools you no longer use, or split marketing mail onto a subdomain with its own SPF record.
Sensible fail policy defaults
We default to ~all because a softfail rollout never costs you legitimate mail while you confirm the sender list is complete. Once your DMARC reports show every real source passing, switch to -all and republish.
After you publish
DNS changes typically propagate within an hour. Verify the live record with our SPF record checker, then finish the authentication stack: generate your DKIM record and DMARC policy, and run the combined deliverability test for a single score across all three.
If you're setting this up across a fleet of cold-email sending domains, that's literally our job. See how we build cold email infrastructure, or read the full SPF, DKIM & DMARC guide for cold email.
Frequently asked questions
How do I create an SPF record?
Select every platform that sends email for your domain above (your inbox provider plus any marketing, transactional, or CRM tools), add dedicated server IPs if you have them, and choose a fail policy. The generator assembles a single valid "v=spf1" record. Publish it as a TXT record on your root domain (host "@" in most DNS dashboards), wait for DNS to propagate, and verify it with an SPF checker.
Where do I publish the SPF record?
In your DNS provider's dashboard (Cloudflare, GoDaddy, Namecheap, Route 53, etc.), create a TXT record on the root of your domain. The host field is usually "@" or left blank. Paste the generated value exactly. If a TXT record starting with "v=spf1" already exists, edit that one instead of adding a second: two SPF records is an automatic permanent error.
How many senders can I include in one SPF record?
SPF allows at most 10 DNS-querying mechanisms (include, a, mx, exists, redirect), and includes nested inside your providers' records count against the same limit. Practically, that means around 4–6 platforms before you're in the danger zone. The generator counts your top-level lookups live; if you're over, remove tools you no longer send from or move bulk senders to a subdomain.
Should I use ~all or -all in my SPF record?
Start with "~all" (softfail) while you confirm every legitimate sender is in the record. Mail from unlisted servers is accepted but marked suspicious, so a forgotten tool doesn't lose you mail. Once your DMARC reports show every source passing, tighten to "-all" (hardfail). Never use "+all", which authorizes the whole internet to send as you.
Does an SPF record fix deliverability by itself?
No. SPF is one of three authentication pillars. You also need DKIM (a cryptographic signature on each message) and DMARC (the policy that ties them together and gets you reporting). For cold outbound you additionally need warmed-up domains and clean list hygiene. Generate all three records, then verify the full setup with the deliverability test.
Keep your outbound landing.
SPF Record Checker
v=spf1 include:_spf.google.com include:sendgrid.net include:mailgun.org ~all
"~all" (softfail) is set, a safe default.
Validate your SPF record. Catch the 10 DNS-lookup limit, duplicate records, and weak fail policies that route outbound to spam.
DKIM Record Generator
google._domainkey.yourdomain.com
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqq…
Setup steps for each provider, plus a builder that turns a raw public key into a correctly formatted TXT record with key-length checks.
DMARC Record Generator
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com
Create a DMARC policy with reporting, pct and alignment options, and guidance on ramping safely from none to reject.
Want us to build your outbound system?
Skip the DIY. We'll orchestrate your entire outbound operation, on infrastructure registered in your name from day one.
Book your free ICP review →