Free tool · no signup
Free SPF record generator
Build one valid SPF record for your domain. Pick the services that send mail for you and watch the ten DNS lookups the standard allows counted live, from each provider's real record, before you publish rather than after it breaks.
Ungated · no email required · unlimited use
In short
- This is a free, ungated SPF record generator. It builds the single TXT record a domain publishes to name the mail servers allowed to send email for it, from a catalogue of 52 sending services plus any term you add by hand.
- An SPF record starts with v=spf1, lists one term per system that sends mail for the domain, and ends with an all mechanism that tells receivers what to do with everyone else. It is published as one TXT record at the root of the domain.
- RFC 7208 §4.6.4 limits an SPF evaluation to ten DNS-querying terms, counted across the entire include tree rather than per record. This generator resolves each provider's own record live and counts what it really costs, so a record it says is inside the limit is inside the limit for a receiving server too.
- A domain may publish exactly one v=spf1 record (RFC 7208 §4.5); a second one is a permerror and receivers do not merge them. Entering a domain loads the record already published on it, so a new sender is added to that record rather than alongside it.
- The generator offers ~all (soft fail) and -all (hard fail) as endings. It does not emit +all, which authorises the whole internet to send as your domain, ?all, which offers no protection, or the deprecated ptr mechanism.
- SPF is one of three records. It validates the envelope sender rather than the visible From address, so it does not stop spoofing on its own, and Gmail and Yahoo require bulk senders to publish SPF, DKIM and DMARC together.
Enter your domain recommended
A domain may publish only one SPF record, so this is the step that stops you adding a second one and breaking the first. It also gets you the publishing instructions for whoever actually runs your DNS.
Planning a domain you do not own yet? You can skip this and still get a valid record — you just will not get the check against what is already published, or the steps for your DNS host.
Tick everything that sends email as your domain
Start with your mailbox provider — nearly every domain needs exactly one — then add every other service that emails your customers from your address.
Nothing selected yet
Not finding your outreach tool?
Sending through a connected mailbox needs no include of its own. The message leaves your mailbox provider’s servers, so the include you already have for Google Workspace, Microsoft 365 or whoever hosts your mail is what authorises it. That is true of SmartReach and of every other tool that connects to your inbox rather than relaying through its own servers — none of them publish an include target, and adding one you found in a forum is how a record ends up with a term that resolves to nothing.
Checked against live DNS and confirmed to need no include of their own: SmartReach, Instantly, Lemlist, Apollo, Woodpecker, Mailshake, Close, Salesloft, Outreach.
Add something that is not on the list
For a provider we do not carry, or your own mail server. ip4 and ip6 ranges cost no lookups at all, so listing addresses directly is the cheapest way to authorise a sender.
Choose what happens to everyone else
What receivers should do with mail from a server you have not listed. Pick the first one unless you are certain your list is complete.
Your record will appear here
Tick your mailbox provider in step 2 and the record builds itself, with every DNS lookup counted against the ten the standard allows.
- Load the record you already publish, or skip it
- Tick everything that sends as your domain
- Copy the record and publish it as one TXT record
Four steps
How to build your SPF record
Start from what you have
Enter your domain and the generator reads any SPF record already published on it, so you are editing the real thing rather than starting a second one.
Tick what sends for you
Your mailbox provider, every sending platform, and the CRM and support tools that email your customers from your domain.
Watch the budget
Each provider’s own record is resolved live, so the count you see is the count a receiving server will spend, including everything nested inside their includes.
Publish, then check it
Copy the record into one TXT record at the root of your domain, wait for the TTL to expire, and run the SPF checker against it to confirm receivers see what you published.
The count matters more than the record. RFC 7208 §4.6.4 allows an evaluation ten DNS-querying terms, and the budget is spent across the whole tree rather than per record: include a provider whose own record contains three includes and all four come out of your ten. That is why this generator resolves every include as you add it instead of counting the lines you can see. If you want the same count on a record that is already published, and the full tree behind it, that is what the SPF checker is for; if you are planning a record before you build it, the measured cost of every provider include is published as a table.
Deliberate omissions
What this generator will not emit
A generator is only worth publishing if it refuses to build a bad record. These five are the ones people most often end up with by accident, and each is left out for a reason from the specification rather than a house preference.
It will not emit +all
Pass-all authorises every server on the internet to send as your domain. It is strictly worse than publishing no SPF record at all, because it tells receivers that the spoofed mail they are looking at is legitimate.
It will not emit ?all
Neutral says you have no opinion about unlisted senders, which is the same protection you get from having no record. It exists in the spec for testing, and it survives in real records only because people copy them.
It will not add a ptr mechanism
Deprecated by RFC 7208 §5.5, slow for every receiver that still honours it, ignored by the ones that do not, and it spends one of your ten lookups either way.
It will not pretend you are inside the limit
The lookup count is read from each provider’s live record, not from a table. When your selection goes over ten, the record is still shown, but it is shown as broken, because that is what a receiving server would make of it.
It will not build you a second record
A domain may publish exactly one v=spf1 record (RFC 7208 §4.5) and receivers do not merge them. If you already have one, the generator starts from it rather than emitting a rival.
The one term worth arguing about is -all. It is the stronger ending and the right destination, but publish it before you are certain every legitimate sender is listed and anything you missed stops being delivered. The usual path is ~all first, then DMARC reporting to find out what is really sending as your domain, then -all once the reports are clean.
Take it with you
Put this generator on your own site
Free to embed, on any site, with no permission needed and nothing to sign. It carries a visible credit back here, which is the whole arrangement. The lookups are still priced from live DNS inside the frame, so an embedded copy is never more stale than this one.
Once it is published
Check it, then do the other two
A record only counts once receivers can see it, so check the published version rather than trusting the one you copied. Then publish DKIM and DMARC: SPF alone validates the envelope sender, not the From address your recipients actually see.
Which servers may send as you
SPF Checker
SPF lists the servers allowed to send mail for your domain. Check that yours is published, resolves, and stays under the ten-lookup limit that silently breaks it.
What it looks like
v=spf1 include:_spf.google.com ~all
Proof the message is really yours
DKIM Checker
DKIM signs every message with a key only you hold. Check that the public key is published, parses, is not revoked, and is long enough to be trusted.
What it looks like
v=DKIM1; k=rsa; p=MIIBIjANBgkq…
What happens when a check fails
DMARC Checker
DMARC tells receivers whether to quarantine or reject mail that fails SPF and DKIM, and where to send the reports. Check your policy, alignment and reporting address.
What it looks like
v=DMARC1; p=reject; pct=100
Or never edit DNS at all
The record you just built, done for you
Every sending tool you bolt on spends part of the same ten-lookup budget, and every new sending domain needs the same three records again. SmartReach hands you sending domains and mailboxes with all three already in place.
- Sending domains and mailboxes bought and authenticated in minutes, no IT ticket
- SPF, DKIM and DMARC configured for you, so there is no record to hand-edit
- Warmup, inbox rotation and ESP matching across unlimited sending accounts
- Every address verified free before a campaign sends, so bounces never touch your domain
“This software is focused on the end receiver as much as the user.”Matt McQuin · Co-founder, ColdlyticsEvery rule on this page is checked against RFC 7208, the specification that defines SPF. Last reviewed . Every include value in the catalogue was confirmed against live DNS on , and what each one costs is re-read from DNS every time you select it rather than remembered here.
FREQUENTLY ASKED QUESTIONS
SPF record questions, answered
Stop fixing deliverability one DNS record at a time.
SmartReach buys and authenticates your sending domains and mailboxes with SPF, DKIM and DMARC already in place, then warms them, rotates them, and verifies every address before you send.