Free SPF Record Generator

An SPF record generator builds a valid Sender Policy Framework (SPF) TXT record string by letting you select your email providers and enter custom IP addresses. It outputs the correct syntax (starting with v=spf1, listing mechanisms such as include, a, mx and ip4/ip6, and ending with an all qualifier) so you can copy it directly into your DNS configuration.

Yes - this SPF generator is completely free, with no signup required. It builds the record client-side in your browser, so nothing is sent to any server.

Each email provider publishes a specific include mechanism. Common ones: Google Workspace uses include:_spf.google.com (4 lookups), Microsoft 365 uses include:spf.protection.outlook.com (2 lookups), SendGrid uses include:sendgrid.net (5 lookups). This generator handles the lookup automatically when you select a provider.

-all (hard fail or "fail") instructs receiving mail servers to reject mail from senders not listed in the record. ~all (softfail) tells them to accept the message but mark it as suspicious. ?all is neutral and +all authorizes everyone (never use it). Start with ~all while testing, then tighten to -all once every legitimate sender is listed.

No. A domain must publish exactly one SPF record. Two or more SPF TXT records cause a PermError and receivers ignore all of them. To authorize several senders, combine their mechanisms into a single record rather than publishing separate SPF records.

The most common cause is exceeding SPF's limit of 10 DNS lookups. Every include, a, mx, ptr and redirect mechanism that must be resolved counts toward the cap; ip4 and ip6 mechanisms cost zero. When you cross 10 lookups the record returns PermError and fails authentication. SPF flattening with AutoSPF keeps you under the limit.

The redirect= modifier hands SPF evaluation to another domain's SPF record instead of using an all qualifier. It is useful when many domains should share one centrally managed policy, but the target record still counts toward the 10-lookup limit.