SPF record generator

Built for getting the syntax right, not for guessing your senders

SPF syntax is unforgiving - a misplaced mechanism, a wrong prefix, or the wrong catch-all can either block legitimate mail or authorize nothing at all. This assembles the record text correctly from choices you make; it cannot know which servers actually send mail for your domain; that list is something only you (or your mail provider's documentation) can supply accurately.

The mechanisms available

• a / mx - authorizes this domain's own A/AAAA record or its mail servers.
• ip4 / ip6 - authorizes a specific address or CIDR range directly.
• include - delegates to a third party's own SPF record - the usual way to authorize a service like Google Workspace or an email platform. Each include costs one of SPF's 10-lookup budget.
• exists - an advanced mechanism based on whether a DNS name resolves; rarely needed.
• redirect - replaces the record entirely with another domain's SPF policy rather than combining with other mechanisms.

Choosing the catch-all

-all (hard fail) is the strongest and most common choice once every real sending source is listed. ~all (soft fail) is a safer starting point while confirming the list is complete, since it flags rather than rejects unlisted servers. +all authorizes literally anyone and should almost never be used.

After generating

Publish the result as a single TXT record at the domain apex, then verify it with the SPF checker - a syntactically valid record is not proof it works as intended until it is checked against what actually resolves.