EmailNa

Home › Free tools

SPF record generator

Tick every service that sends email using your domain, and the generator builds one correct SPF record to paste into your DNS. It counts lookups so you stay under the limit of 10.

Services that send email for your domain
Your own servers

Privacy: this tool runs entirely in your browser. Nothing you paste is sent to EmailNa or anyone else.

How to add the record

  1. Sign in where your domain's DNS is managed, such as Cloudflare, Spaceship, GoDaddy or Namecheap.
  2. Look for an existing TXT record starting with v=spf1. If there is one, edit it. A domain must have only one SPF record.
  3. Otherwise add a new TXT record with the host @ and paste the value.
  4. Wait a few minutes, then test it with the SPF and DMARC checker.

~all or -all?

~all (soft fail) tells receivers that mail from unlisted servers is suspicious. -all (hard fail) says it should be refused. Most domains use ~all together with DMARC, which then decides what happens to failing mail. Use -all only when you are sure every service that sends as you is listed.

The 10-lookup limit

Each include, a and mx in an SPF record makes the receiving server look up more DNS records, and the includes often contain more lookups of their own. SPF allows 10 lookups in total; go over and SPF fails for every email. If you're near the limit, remove services you no longer use.

Check with your provider

The include values above are the ones these services publish, but they do change. Some services, such as Mailchimp, Postmark and Brevo, don't need an SPF include at all for most accounts, because they handle the bounce address themselves and authenticate with DKIM. Some values also depend on your region: Zoho Mail accounts in Europe use zohomail.eu and in India zohomail.in, and SparkPost EU uses _spf.eu.sparkpostmail.com. Check your service's own setup instructions and use what they give you.

Questions people ask

Can I have two SPF records?
No. Two SPF records make SPF fail. Merge everything into one record, which is what this generator does.
Where does the SPF record go?
In a TXT record on your domain itself, usually shown as host @.
Is SPF enough to stop spoofing?
No. Use SPF with DKIM and a DMARC record. See the DMARC generator.

Related guides