SPF record generator

The generator reads your domain's SPF record, lets you add servers and services, and gives you the finished value to copy. Along the way it counts the DNS lookups, including the ones inside included records. Free, no sign-up.

An SPF record is a TXT record in DNS that lists the servers allowed to send mail for a domain. Receivers compare the IP address a message comes from against that list. Most mistakes do not happen when the record is first created but later: a new service comes along, its record gets added next to the old one instead of into it, or the number of DNS lookups quietly grows past ten. That is why the generator starts with what is already published.

Build your SPF record

When reading, the generator queries the domain's TXT record. When generating, it also follows every include: and redirect= to count the DNS lookups. Only publicly available records are read, and the generator changes nothing in your domain's DNS: publishing the record is up to you.

The parts of an SPF record

An SPF record always starts with v=spf1, followed by the terms that say who may send, and ends with the policy for everyone else. Receivers read from left to right and stop at the first match.

The policy at the end: -all, ~all or ?all

• -all (Fail) means: anyone not listed may not send, and the receiver should reject the message. Right when you are sure you know every sending system.
• ~all (SoftFail) means: anyone not listed is suspicious, but the message is accepted and flagged. This is the usual setting, because DMARC decides what happens to failed messages anyway.
• ?all (Neutral) means: no statement. The record has practically no effect.
• +all lets every server in the world send in your name. The generator does not offer it. If it finds it in an existing record, it replaces it with ~all and tells you so.

The limit of ten DNS lookups

Every include:, a, mx, ptr, exists: and redirect= costs the receiver one DNS lookup, and the lookups inside included records count too. ip4:, ip6: and all cost nothing. RFC 7208 allows at most ten in section 4.6.4. At eleven, the receiver aborts with a PermError, and the whole record behaves as if it did not exist.

Microsoft 365, Google Workspace and many newsletter services bring several lookups of their own. Include three or four of them and you can easily go over the limit without seeing it in the record itself. That is why the generator follows every include: and shows you the number a receiver actually reaches, broken down by service. If it gets too high, three things help: remove services that no longer send, replace a and mx with fixed addresses, and route mail from devices and applications through a relay.

Long records: 255 characters per string

A TXT record consists of one or more strings of at most 255 characters each. If the SPF record is longer, it has to be spread across several. Receivers join the parts back together without a separator, as RFC 7208, section 3.3, specifies. So the generator splits at a space and keeps the space at the start of the next part.

Many DNS interfaces split long values on their own; there you paste the record in one piece. Others expect the parts in quotation marks one after another, such as "v=spf1 … ip4:198.51.100.7" " include:_spf.google.com ~all". For that case, the generator shows the split version. Separately, RFC 7208 recommends in section 3.4 keeping the whole record under about 450 bytes so the DNS response stays small.

Examples for common setups

Microsoft 365

v=spf1 include:spf.protection.outlook.com ~all

The record for a domain whose mailboxes are hosted in Microsoft 365 and that sends through nothing else. Scanners, line-of-business applications or an online store that send mail on their own need an entry of their own.

Google Workspace

v=spf1 include:_spf.google.com ~all

The same for Google Workspace. If you move from Microsoft 365 to Google or the other way around, replace the include: once the move is complete instead of adding a second one next to it.

Your own mail server

v=spf1 ip4:203.0.113.25 a:mail.yourcompany.com ~all

Your own server with a fixed public IPv4 address, here 203.0.113.25 as a placeholder, plus the host mail.yourcompany.com. The fixed address costs no DNS lookup, the host costs one. If the server also has IPv6, add its address as ip6:.

Mailboxes in Microsoft 365, devices through a relay

v=spf1 include:spf.protection.outlook.com include:spf.spamgo.de ~all

A common setup in small businesses: the mailboxes are in Microsoft 365, while scanners, the ERP system and the online store send through an SMTP relay. Here that relay is MailBridge; with another provider, its include: goes in that spot.

A domain that never sends mail

v=spf1 -all

For domains that only host a website or are just registered. The record tells receivers that any message using this sender domain is forged.

Publish an SPF record in DNS

1. Build the record with the generator. If the domain already has an SPF record, read it first and edit it instead of adding a second one.
2. Log in to the provider that manages your domain's DNS zone and open the DNS record settings.
3. If there is already a TXT record that starts with v=spf1, replace its value. Otherwise add a new TXT record and enter @ as the host, meaning the domain itself.
4. Paste the value without adding quotation marks. If the interface wants separate strings, use the split version the generator shows for long records.
5. Save, wait a few minutes, then check the domain with the checker. It reads the published record and counts the lookups again.

How SPF works together with DKIM and DMARC, and in which order to switch over without mail getting stuck, is covered in the guide Set up SPF, DKIM and DMARC.

Can a domain have two SPF records?

No. Each domain may have exactly one TXT record that starts with v=spf1. If there are two, receivers abort the check with a PermError, and the domain ends up worse off than with no SPF at all. When you add a new service, its include goes into the existing record. That is exactly why this generator reads the existing record first.

Should I use -all or ~all?

For most domains, ~all. Unlisted senders are treated as suspicious, but their mail is not rejected for that reason alone; your DMARC policy decides what happens to it. -all makes sense once you are sure every sending system is in the record, including scanners, your online store and your newsletter tool. ?all offers no protection, and +all lets anyone send.

What do I do if my SPF record needs more than ten DNS lookups?

First, check which includes are still needed: services that stopped sending long ago often stay in the record for years. Next, replace a and mx with ip4 where the addresses rarely change, because ip4 and ip6 cost no lookup. If that is not enough, route your sending through a relay so that a single include replaces several.

Does a subdomain need its own SPF record?

Yes, if mail is sent from it. SPF is not inherited: for newsletter.yourcompany.com, only the record published at exactly that name applies, not the one for yourcompany.com. In that case, enter the subdomain as the domain above and publish the record under its name.

What is the difference between include and redirect?

include checks a provider's record as well and carries on with your own record if the sender does not match there. redirect hands the whole decision over to another domain, and the all at the end is dropped. redirect fits when several domains should share one record: you maintain one, and the others point to it.

Does the SPF generator store what I enter?

No. The domain, hosts and IP addresses reach our server only when you click, and they are used there only to build and check the record. We keep no list of domains, there is no sign-up and there are no cookies. The privacy policy describes exactly what is transmitted.

How MailBridge gets into your SPF record

MailBridge is an SMTP relay: devices and applications hand their mail to our servers, and those send it through your sender domain. All it takes in the SPF record is a single include:spf.spamgo.de, no matter how many servers we run and whether we replace one. The generator only adds it if you check the box for it; for every other sender it works just the same.

In the portal, the SPF record found and the record expected are shown side by side for every domain. If one already exists, the portal adds our include: and keeps the entries for other senders. All domains are checked again daily.

Standards and status of this page

This page is published by MailBridge, a service of LOGIN SystemHaus GmbH in Wiesbaden, Germany. All servers are located in Germany.

SPF is defined in RFC 7208 (2014). The limit of ten DNS lookups and that of two empty lookups are in section 4.6.4, the rule against multiple SPF records in section 3.2, joining long records from several strings in section 3.3 and the size recommendation in section 3.4. The recommendation to avoid ptr is in section 5.5, and the rule that redirect= does not apply next to an all is in section 6.1. The limit of 255 characters per string goes back to RFC 1035, section 3.3.

Last checked on October 11, 2026.