# SPF Record Generator

URL: https://iblockspam.com/tools/spf-generator
Last updated: 2026-10-09

> Pick the services that send your email, add your own servers, and get one valid SPF record with an estimate of its DNS lookups.

Free tool: Build a valid SPF record from your mail providers, with a DNS lookup count. Use it at https://iblockspam.com/tools/spf-generator

## How to use the SPF Generator

1. Tick each service that sends mail using your domain in the envelope sender (the bounce address).
2. Add the IP addresses of any servers you run yourself, such as an on-premises mail server, a scanner or a website that sends mail.
3. Add any other `include` value a provider's setup guide gives you.
4. Choose the ending and generate the record: `~all` while you're still discovering senders, `-all` once every sender is listed and DKIM-signed. Our guide to [SPF softfail vs hardfail](https://iblockspam.com/blog/spf-softfail-vs-hardfail) explains the trade-off.
5. Publish it as a single TXT record on your domain, then check it with the [SPF Checker](https://iblockspam.com/tools/spf-checker).

The generator works without JavaScript and never queries DNS. Your choices aren't stored.

## Provider include values

Each value comes from the provider's own documentation. "Lookups" is what the include costs, including nested includes, measured on 9 October 2026. Providers change their records, so treat it as an estimate.

| Provider | Mechanism | Lookups | Source |
|---|---|---|---|
| Microsoft 365 / Exchange Online | `include:spf.protection.outlook.com` | 1 | [Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configure) |
| Google Workspace | `include:_spf.google.com` | 1 | [Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/security/set-up-spf) |
| Zoho Mail | `include:zoho.com` | 5 | [Zoho Mail help](https://www.zoho.com/mail/help/adminconsole/spf-configuration.html) |
| GoDaddy email | `include:secureserver.net` | 3 | [GoDaddy help](https://www.godaddy.com/help/add-an-spf-record-19218) |
| Fastmail | `include:spf.messagingengine.com` | 1 | [Fastmail help](https://www.fastmail.help/hc/en-us/articles/360060591153-Manual-DNS-configuration) |
| Proton Mail | `include:_spf.protonmail.ch` | 2 | [Proton support](https://proton.me/support/anti-spoofing-custom-domain) |
| Amazon SES | `include:amazonses.com` | 1 | [Amazon SES docs](https://docs.aws.amazon.com/ses/latest/dg/mail-from.html) |
| SendGrid | `include:sendgrid.net` | 2 | [Twilio SendGrid docs](https://www.twilio.com/docs/sendgrid/ui/sending-email/verify-sender-with-spf) |
| Mailgun | `include:mailgun.org` | 5 | [Mailgun docs](https://documentation.mailgun.com/docs/mailgun/user-manual/domains/domains-verify) |
| Zendesk | `include:mail.zendesk.com` | 1 | [Zendesk help](https://support.zendesk.com/hc/en-us/articles/4408832543770) |
| Salesforce | `include:_spf.salesforce.com` | 2 | [Salesforce Help](https://help.salesforce.com/s/articleView?id=sales.emailadmin_spf_include_salesforce.htm&language=en_US&type=5) |
| Freshdesk | `include:email.freshdesk.com` | 7 | [Freshdesk support](https://support.freshdesk.com/support/solutions/articles/43170) |

Two caveats: Amazon SES only needs the include on a custom MAIL FROM subdomain, and GoDaddy's include already contains Microsoft's, so don't add both.

## The rules the generator applies

- **One record.** A domain must not publish more than one SPF record ([RFC 7208 section 3.2](https://www.rfc-editor.org/rfc/rfc7208.html#section-3.2)).
- **10 DNS lookups.** `include`, `a`, `mx`, `ptr`, `exists` and `redirect` each cost a lookup, nested ones included. Over 10 is PermError ([section 4.6.4](https://www.rfc-editor.org/rfc/rfc7208.html#section-4.6.4)). `ip4`, `ip6` and `all` are free.
- **255 characters per string.** A longer record must be split into several quoted strings in one TXT record. Receivers join them without adding spaces ([section 3.3](https://www.rfc-editor.org/rfc/rfc7208.html#section-3.3)), so the generator keeps the space at the start of each continuation.
- **Keep it small.** RFC 7208 [section 3.4](https://www.rfc-editor.org/rfc/rfc7208.html#section-3.4) asks for answers that fit in 512 bytes. We warn above 450 characters.
- **No `ptr`.** RFC 7208 says not to publish it, so the generator doesn't offer it.
- Private IP addresses are left out: they never send mail to the internet.

## Common problems and fixes

**You already have an SPF record.** Don't publish a second one. Copy the terms you need into your existing record, or rebuild the whole record here with every sender ticked.

**Too many lookups.** Remove services you no longer use, replace `a` and `mx` with `ip4` ranges, or send bulk mail from a subdomain with its own record. See [fixing SPF PermError from too many DNS lookups](https://iblockspam.com/blog/spf-too-many-dns-lookups).

**Behind a filtering gateway.** Inbound filtering doesn't change your SPF record. If you send through an outbound relay, add the include your relay provider gives you. iBlockSpam customers find theirs in the setup wizard.

## Limitations

- Lookup counts for presets are measured estimates; your own includes count as 1 each here. The [SPF Checker](https://iblockspam.com/tools/spf-checker) gives the real number once the record is live.
- SPF alone doesn't stop spoofing of the From address people see. Pair it with DKIM and a [DMARC record](https://iblockspam.com/tools/dmarc-generator).

## Related

See [SPF record syntax examples](https://iblockspam.com/blog/spf-record-syntax-examples) for every mechanism explained, or [SPF records by email provider](https://iblockspam.com/spf) for each provider's exact include, with notes on services that don't need one.

## Frequently asked questions

### Where do I put the SPF record?

Publish it as a TXT record on the domain itself (the host is often shown as @ or left blank). A domain must have only one SPF record. If you already have one, merge the new terms into it instead of adding a second.

### Which ending should a new SPF record use?

Start with ~all (soft fail), which asks receivers to treat mail from unlisted servers as suspicious, while you are still finding every sender. Switch to -all (fail) once every sender is listed and signs with DKIM. Microsoft says DMARC is effectively ignored for ~all failures on unsigned mail, so DKIM matters either way.

### Why does the generator warn about 10 lookups?

RFC 7208 limits SPF evaluation to 10 DNS-querying terms, including the ones nested inside each include. Over the limit, receivers return PermError and SPF fails for all your mail. Some providers' includes cost several lookups each.

### Do I need to add Mailchimp, Klaviyo or HubSpot?

Usually not. Many marketing platforms send with their own bounce address, so your SPF record doesn't apply to them; they ask you to set up DKIM instead. Add an include only when the service's own setup guide tells you to.

### Does the generator check my DNS?

No. It only builds the record from your choices and never queries DNS. After you publish it, use the SPF Checker to read the live record and count every nested lookup.

---

Source: iBlockSpam, https://iblockspam.com/tools/spf-generator (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt