SPF Record Generator
Generate an SPF record for Google Workspace, Microsoft 365, Amazon SES, SendGrid, Mailgun, Postmark and your own servers, or check an existing one term by term.
Free · No sign-up · Your inputs stay in your browser
Input
Generate or check an SPF record
Output
v=spf1 mx ip4:203.0.113.10 include:_spf.google.com include:amazonses.com ~all
TXT @
v=spf1 mx ip4:203.0.113.10 include:_spf.google.com include:amazonses.com ~all
77 characters
| Term | Result | Matches |
|---|---|---|
| mx | pass | the mail servers in this domain's MX records (one lookup, plus one per MX host) |
| ip4:203.0.113.10 | pass | the IPv4 address or range 203.0.113.10 |
| include:_spf.google.com | pass | whatever _spf.google.com's SPF record allows |
| include:amazonses.com | pass | whatever amazonses.com's SPF record allows |
| ~all | softfail | every other sender |
DNS lookups at the top level
3 of 10
Each include adds its own lookups, which this page cannot resolve without querying DNS.
Publish it as one TXT record at the domain itself (@). A domain may have only one SPF record: two give a permerror, so merge them. SPF checks the envelope sender (Return-Path), not the From a reader sees; DMARC is what ties the two together. ~all with DMARC enforcing is the common setting.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
The ten-lookup limit
RFC 7208 limits SPF evaluation to ten DNS lookups, counting every include, a, mx, ptr, exists and redirect, including those inside the included records. A domain that sends through several services passes ten easily, and then every message fails SPF with a permerror. Flatten includes into ip4 ranges or move some senders to subdomains.
SPF alone is not enough
SPF checks the envelope sender (Return-Path), which readers never see, not the From header. A message can pass SPF for a bulk sender's domain and still claim to be from you. DMARC is what requires one of SPF or DKIM to align with the From domain.