How to use the SPF Generator
- Tick each service that sends mail using your domain in the envelope sender (the bounce address).
- Add the IP addresses of any servers you run yourself, such as an on-premises mail server, a scanner or a website that sends mail.
- Add any other
includevalue a provider's setup guide gives you. - Choose the ending and generate the record:
~allwhile you're still discovering senders,-allonce every sender is listed and DKIM-signed. Our guide to SPF softfail vs hardfail explains the trade-off. - Publish it as a single TXT record on your domain, then check it with the SPF Checker.
The generator works without JavaScript and never queries DNS. Your choices aren't stored.
Provider include values
Each value comes from the provider's own documentation. "Lookups" is what the include costs, including nested includes, measured on 9 October 2026. Providers change their records, so treat it as an estimate.
| Provider | Mechanism | Lookups | Source |
|---|---|---|---|
| Microsoft 365 / Exchange Online | include:spf.protection.outlook.com |
1 | Microsoft Learn |
| Google Workspace | include:_spf.google.com |
1 | Google Workspace Admin Help |
| Zoho Mail | include:zoho.com |
5 | Zoho Mail help |
| GoDaddy email | include:secureserver.net |
3 | GoDaddy help |
| Fastmail | include:spf.messagingengine.com |
1 | Fastmail help |
| Proton Mail | include:_spf.protonmail.ch |
2 | Proton support |
| Amazon SES | include:amazonses.com |
1 | Amazon SES docs |
| SendGrid | include:sendgrid.net |
2 | Twilio SendGrid docs |
| Mailgun | include:mailgun.org |
5 | Mailgun docs |
| Zendesk | include:mail.zendesk.com |
1 | Zendesk help |
| Salesforce | include:_spf.salesforce.com |
2 | Salesforce Help |
| Freshdesk | include:email.freshdesk.com |
7 | Freshdesk support |
Two caveats: Amazon SES only needs the include on a custom MAIL FROM subdomain, and GoDaddy's include already contains Microsoft's, so don't add both.
The rules the generator applies
- One record. A domain must not publish more than one SPF record (RFC 7208 section 3.2).
- 10 DNS lookups.
include,a,mx,ptr,existsandredirecteach cost a lookup, nested ones included. Over 10 is PermError (section 4.6.4).ip4,ip6andallare free. - 255 characters per string. A longer record must be split into several quoted strings in one TXT record. Receivers join them without adding spaces (section 3.3), so the generator keeps the space at the start of each continuation.
- Keep it small. RFC 7208 section 3.4 asks for answers that fit in 512 bytes. We warn above 450 characters.
- No
ptr. RFC 7208 says not to publish it, so the generator doesn't offer it. - Private IP addresses are left out: they never send mail to the internet.
Common problems and fixes
You already have an SPF record. Don't publish a second one. Copy the terms you need into your existing record, or rebuild the whole record here with every sender ticked.
Too many lookups. Remove services you no longer use, replace a and mx with ip4 ranges, or send bulk mail from a subdomain with its own record. See fixing SPF PermError from too many DNS lookups.
Behind a filtering gateway. Inbound filtering doesn't change your SPF record. If you send through an outbound relay, add the include your relay provider gives you. iBlockSpam customers find theirs in the setup wizard.
Limitations
- Lookup counts for presets are measured estimates; your own includes count as 1 each here. The SPF Checker gives the real number once the record is live.
- SPF alone doesn't stop spoofing of the From address people see. Pair it with DKIM and a DMARC record.
Related
See SPF record syntax examples for every mechanism explained, or SPF records by email provider for each provider's exact include, with notes on services that don't need one.
Frequently asked questions
Where do I put the SPF record?
Publish it as a TXT record on the domain itself (the host is often shown as @ or left blank). A domain must have only one SPF record. If you already have one, merge the new terms into it instead of adding a second.
Which ending should a new SPF record use?
Start with ~all (soft fail), which asks receivers to treat mail from unlisted servers as suspicious, while you are still finding every sender. Switch to -all (fail) once every sender is listed and signs with DKIM. Microsoft says DMARC is effectively ignored for ~all failures on unsigned mail, so DKIM matters either way.
Why does the generator warn about 10 lookups?
RFC 7208 limits SPF evaluation to 10 DNS-querying terms, including the ones nested inside each include. Over the limit, receivers return PermError and SPF fails for all your mail. Some providers' includes cost several lookups each.
Do I need to add Mailchimp, Klaviyo or HubSpot?
Usually not. Many marketing platforms send with their own bounce address, so your SPF record doesn't apply to them; they ask you to set up DKIM instead. Add an include only when the service's own setup guide tells you to.
Does the generator check my DNS?
No. It only builds the record from your choices and never queries DNS. After you publish it, use the SPF Checker to read the live record and count every nested lookup.
Related guides
SPF record syntax and examples
SPF record syntax explained: mechanisms, qualifiers and modifiers, with copy-ready examples for Microsoft 365, Google Workspace, subdomains and parked domains.
9 min read SPF, DKIM & DMARCHow to fix SPF PermError: too many DNS lookups
Why SPF breaks at 10 DNS lookups, how to count them, and step-by-step fixes for Microsoft 365 and Google Workspace domains with many senders.
8 min read SPF, DKIM & DMARCSPF softfail vs hardfail: should you use ~all or -all?
What ~all, -all and ?all mean in SPF, what receivers really do with each, how DMARC changes the choice, and which one to use for sending and parked domains.
8 min read