# SPF Record Generator: Build a Valid SPF Record

URL: https://email-validation.org/tools/spf-generator/
Updated: 2026-11-06

> Documentation index: https://email-validation.org/llms.txt

Tick the services that send mail as your domain, add your own servers and choose how to treat everything else. The
record updates as you type and is checked against [RFC 7208](https://www.rfc-editor.org/rfc/rfc7208). Everything runs
in your browser.

## Before you start: list every sender

SPF only helps when it lists every system that sends mail with your domain in the envelope sender: your mailbox
provider, your newsletter or marketing tool, your help desk, billing and transactional mail, and any server of your
own. Look at the headers of recent messages from each (the `Return-Path` and `Received` lines), or at DMARC aggregate
reports, which list every source that sent as your domain.

Many marketing and transactional services send with their own bounce domain and sign with DKIM on yours; those need no
`include:` on your domain. Follow each provider's current setup page: include names change, and an include you do not
need still costs DNS lookups.

## Publish it

1. In your DNS host, add a **TXT** record on the domain itself (host `@` or blank), with the record as its value.
2. Remove any older `v=spf1` record first: a domain may have only one
   ([RFC 7208 §4.5](https://www.rfc-editor.org/rfc/rfc7208#section-4.5)).
3. Wait for the record's TTL to pass, then test it with our [SPF checker](https://email-validation.org/tools/spf-checker/), which also counts the
   lookups inside each include.

## Stay under 10 lookups

Each `include`, `a`, `mx`, `ptr`, `exists` and `redirect` costs a DNS lookup, and so does every such term inside the
records you include. Receivers stop after 10 and SPF fails
([§4.6.4](https://www.rfc-editor.org/rfc/rfc7208#section-4.6.4)). Some provider includes cost one lookup, others four
or five, so a handful of services can reach the limit. The generator counts the lookups in your own record only; after
publishing, the SPF checker counts the real total. Ways to stay under it:

- Leave out `a` and `mx` unless those servers really send mail, or list their addresses with `ip4:`/`ip6:`.
- Remove services you no longer use.
- Send marketing or bulk mail from a subdomain (for example `news.example.com`) with its own SPF record.

Avoid "SPF flattening" services that replace includes with long IP lists unless they update the list for you:
providers change their ranges without notice.

## Which ending to choose

- `~all` (soft fail): unlisted servers are not yours. The usual choice, and enough once DMARC is enforced.
- `-all` (fail): the same, stated firmly. Use it when you are sure every sender is listed, and on domains that send
  no mail (`v=spf1 -all`).
- `?all` (neutral): gives no protection; use it only for a short test.
- Never `+all`: it authorises every server on the internet.

SPF checks the envelope sender, not the From address people see. To protect that, publish DMARC as well: our
[DMARC generator](https://email-validation.org/tools/dmarc-generator/) builds the record.

Checking email addresses rather than domains? Try our [free email checker](https://email-validation.org/email-checker/) or see [pricing](https://email-validation.org/pricing/) for lists and the API.

## Frequently asked questions

### Should my SPF record end in ~all or -all?

Both tell receivers that unlisted servers are not yours. ~all (soft fail) is the common choice while you confirm every sender is listed; -all is fine once you are sure, and for domains that send no mail.

### Where do I publish the SPF record?

As a TXT record on the domain itself (host @ or blank in most DNS panels). Replace any existing v=spf1 record instead of adding a second one.

### Do I need an include for my newsletter tool?

Only if its setup instructions ask for one. Many services send with their own bounce domain and sign with DKIM on yours, so they need no include on your domain.