XunLMove cross-border work forward
English
中文EnglishEspañolDeutschPortuguêsРусский
My tools

SPF Record Generator

Pick your sending services and server IPs, get an SPF record you can paste into DNS, and check it stays under 10 DNS lookups.

Built in your browser · live lookup count

Optional: enter your domain to import its current SPF record and count lookups.

Which services send mail as your domain?

Count your mailbox provider plus marketing, helpdesk and CRM tools; if unsure, look at the raw headers of a real message.

Mailbox providers

Marketing and transactional

Helpdesk and CRM

Your own servers
What should happen to mail from any other server?

Your SPF record

Host / name
@
Record Type
TXT
Record Value

    YOUR NEXT STEP

    Turn a website check into a monitoring routine

    Create a company account to manage sites and notifications. Pro supports 5 sites and 5-minute availability monitoring, with deep diagnostics available according to your plan and permissions.

    Create company accountExplore ProContact us

    New companies receive a 14-day Pro trial, with no card required. Trials exclude the paid monthly credit grant.

    Already have an account? Open your workspace →

    How to use it

    1. (Optional) Enter your domain and import its current SPF so you do not drop services already in use.
    2. Tick every service that sends as your domain and add your own server IPs.
    3. Choose ~all or -all and press “Count lookups” to confirm you are under 10.
    4. In DNS, replace the single TXT record at @ with the generated value, then verify it with the checker.

    What SPF does

    SPF (Sender Policy Framework) is a list of authorised sending servers published in a TXT record. A receiver checks whether the connecting IP is on that list and, together with DKIM and DMARC, decides between inbox, spam folder or rejection.

    Since 2024 Gmail and Yahoo require every sending domain to have SPF or DKIM, and bulk senders (over 5,000 messages a day) need all three, or mail is throttled or rejected.

    The 10-lookup limit

    RFC 7208 caps include, a, mx, exists, redirect and ptr at 10 DNS lookups per SPF evaluation, counting nested includes. ip4, ip6 and all are free. Going over gives permerror, which many receivers treat as an SPF failure.

    Common fixes: remove services you no longer use, drop unnecessary a and mx, write fixed servers as ip4/ip6, and send marketing mail from a subdomain such as news.example.com with its own SPF.

    ~all or -all?

    With DMARC in place the DMARC policy decides what gets blocked, so ~all and -all behave much the same; ~all is kinder to forwarded mail and is what most providers recommend. Consider -all only once DMARC reports confirm every sender is listed.

    Frequently asked questions

    Can a domain have two SPF records?

    No. Two TXT records starting with v=spf1 make SPF fail with permerror. When you add a service, merge its include into the existing record instead of creating a new one.

    What goes in the host field?

    Use “@” for the root domain (some panels want it empty) or the subdomain label, e.g. news. Choose type TXT, not the obsolete SPF type.

    I have SPF but mail still lands in spam. Why?

    SPF only vouches for the server; DMARC also needs the SPF or DKIM domain to align with the From address. Set up DKIM and DMARC too, and check blacklists, content and sending volume.

    Does a domain that sends no mail need SPF?

    Yes: publish v=spf1 -all plus a DMARC record with p=reject so nobody can use the domain for phishing.

    SPF record generator practical guide and common questions

    What is an SPF record and why do I need one?

    An SPF record is a TXT record starting with v=spf1 that lists the servers allowed to send mail for your domain, so receivers can tell whether a message comes from an authorised source.

    Who is this for, and when is it useful?

    Webmasters and IT admins setting up business email, adding a marketing or helpdesk sender, or seeing mail rejected or sent to spam because SPF fails.

    How do I build one SPF record for several sending services?

    Enter your domain to import the current record, tick the sending services and add server IPs, choose ~all or -all, count the DNS lookups and copy the result into a TXT record.

    How should I read the 10-lookup limit and ~all versus -all?

    Lookups must stay at 10 or fewer or SPF returns permerror, and a domain may have only one SPF record. ~all with DMARC is the safe default; -all suits a setup where every sender is confirmed.

    Where is the work performed, and which services receive data?

    The record is built in your browser. Importing or counting lookups sends only the domain or record to this site’s server, which reads TXT records over public DNS; nothing is stored.