Should my SPF record end in ~all or -all?

Both tell receivers that unlisted servers are not yours. ~all (soft fail) is the common choice while you confirm every sender is listed; -all is fine once you are sure, and for domains that send no mail.

Where do I publish the SPF record?

As a TXT record on the domain itself (host @ or blank in most DNS panels). Replace any existing v=spf1 record instead of adding a second one.

SPF record generator

Q: Do I need an include for my newsletter tool?

Only if its setup instructions ask for one. Many services send with their own bounce domain and sign with DKIM on yours, so they need no include on your domain.

TXT at your domain

v=spf1 mx ~all

Ends with ~all.
Mail from unlisted servers soft-fails SPF; with DMARC at quarantine or reject, that is enough.
1 of 10 DNS lookups used.
Includes inside included records count too; this total covers them.

Tick the services that send mail as your domain, add your own servers and choose how to treat everything else. The record updates as you type and is checked against RFC 7208. Everything runs in your browser.

Before you start: list every sender

SPF only helps when it lists every system that sends mail with your domain in the envelope sender: your mailbox provider, your newsletter or marketing tool, your help desk, billing and transactional mail, and any server of your own. Look at the headers of recent messages from each (the Return-Path and Received lines), or at DMARC aggregate reports, which list every source that sent as your domain.

Many marketing and transactional services send with their own bounce domain and sign with DKIM on yours; those need no include: on your domain. Follow each provider's current setup page: include names change, and an include you do not need still costs DNS lookups.

Publish it

In your DNS host, add a TXT record on the domain itself (host @ or blank), with the record as its value.
Remove any older v=spf1 record first: a domain may have only one (RFC 7208 §4.5).
Wait for the record's TTL to pass, then test it with our SPF checker, which also counts the lookups inside each include.

Stay under 10 lookups

Each include, a, mx, ptr, exists and redirect costs a DNS lookup, and so does every such term inside the records you include. Receivers stop after 10 and SPF fails (§4.6.4). Some provider includes cost one lookup, others four or five, so a handful of services can reach the limit. The generator counts the lookups in your own record only; after publishing, the SPF checker counts the real total. Ways to stay under it:

Leave out a and mx unless those servers really send mail, or list their addresses with ip4:/ip6:.
Remove services you no longer use.
Send marketing or bulk mail from a subdomain (for example news.example.com) with its own SPF record.

Avoid "SPF flattening" services that replace includes with long IP lists unless they update the list for you: providers change their ranges without notice.

Which ending to choose

~all (soft fail): unlisted servers are not yours. The usual choice, and enough once DMARC is enforced.
-all (fail): the same, stated firmly. Use it when you are sure every sender is listed, and on domains that send no mail (v=spf1 -all).
?all (neutral): gives no protection; use it only for a short test.
Never +all: it authorises every server on the internet.

SPF checks the envelope sender, not the From address people see. To protect that, publish DMARC as well: our DMARC generator builds the record.

Checking email addresses rather than domains? Try our free email checker or see pricing for lists and the API.