FindLeadEmails
Email intelligence
Try it for free
Tool

SPF record generator

Build a v=spf1 TXT record from the providers you actually send through.

This tool only reads public DNS or runs in your browser. It does not spend verification credits.

v=spf1 include:_spf.google.com ~all

Publish as a single TXT record on the apex. Never create two SPF records.

What this generator is for

SPF is a TXT record that lists who may send mail as your domain. The format is easy to get slightly wrong and painful to debug later: two records instead of one, too many lookups (the "10 DNS lookup" cap), an include: for a tool you turned off two years ago.

Tick the providers you actually send through. We draft a single v=spf1 … ~all record. Copy it into DNS. Then confirm with the deliverability checker.

This runs in your browser. No credits. Uncapped.

The rules that actually bite

  • One SPF record per domain. Merge includes into a single TXT. A second v=spf1 is a bug, not a backup.
  • Include only what you send through. Google Workspace, Microsoft 365, Mailgun, SendGrid, Amazon SES, Zoho, Fastmail — each include: costs lookups. Leftover ESPs from old marketing tools are how you exceed the lookup limit and fail SPF for *everyone*.
  • `~` vs `-`. ~all (soft fail) is the default here because it is the safe publish. -all (hard fail) is for domains that are sure no legitimate mail comes from anywhere else. If you still have a random WordPress plugin sending "contact form" mail, -all will punish you.

How to publish

  1. Generate the record on this page.
  2. Open DNS wherever the NS records point — often Cloudflare or GoDaddy, not the Google Admin console.
  3. Add a TXT record on @ / apex with the generated value.
  4. Wait for TTL. Check the live lookup.
  5. If you use Google Workspace, their Admin > Account > Domains view can also confirm.

Step-by-step per host lives under /dns. Example: SPF for Google Workspace.

What SPF does not do

SPF does not encrypt mail. It does not verify recipients. It does not replace DKIM. A domain can pass SPF and still fail DMARC if the visible From: domain does not align. Read the three-record explainer if that sentence was opaque.

Common mistakes

  • Publishing SPF on www instead of the apex.
  • Creating a new SPF record next to the old one "just to add SendGrid."
  • Copying someone else's record from a blog post that include:s a host you do not use.
  • Forgetting that Google *and* a sequencer both need includes if both send as @yourdomain.com.

After SPF

Add DKIM at the provider, publish DMARC at p=none, then warm the domain if it is new.

Related