SPF Record Generator

List every service that sends email for your domain: your mailbox provider (Google Workspace or Microsoft 365), marketing platforms, transactional senders, your CRM, help desk, and any mail server you run. Each has a documented SPF mechanism, usually an include. Select them in the generator, choose how receivers should treat everything else (~all to start), and publish the result as a TXT record at your domain root. The hard part isn't syntax, it's remembering every service. DMARC aggregate reports are how you find the ones you forgot.

No. The SPF standard requires exactly one: if receivers find two v=spf1 TXT records, the result is a permerror and both are effectively ignored, which is worse than having neither. If your domain already has an SPF record, merge the new mechanisms into it: keep one v=spf1 at the front, combine the include and ip mechanisms, and keep a single all qualifier at the end.

Receivers stop evaluating an SPF record after 10 DNS lookups; anything more returns permerror, which mailbox providers treat as a failure. The mechanisms a, mx, include, exists, redirect and ptr each cost one lookup, and includes often trigger further lookups inside themselves, so a record that lists 6 includes can silently blow past the limit. ip4 and ip6 mechanisms cost nothing, which is why the fix for a too-long record is usually replacing includes with your providers' published IP ranges or using a flattening service.

Use ~all if the domain sends email, and -all only if it sends none. ~all (softfail) asks receivers to accept but mark unlisted senders; -all (hard fail) tells them to refuse outright, which also refuses forwarded mail that was legitimately yours. Once DMARC is enforcing, the two give the same protection against spoofing, so on a sending domain ~all is the end state rather than a step toward -all. What tightens over time is the DMARC policy. Avoid ?all: it is equivalent to having no opinion, offers zero protection, and reads as neglect.

Google Workspace documents include:_spf.google.com and Microsoft 365 documents include:spf.protection.outlook.com, one include each, both built into this generator. Everything Google or Microsoft sends for you is covered by that single mechanism, so you don't add individual server IPs for them. If you also send through a marketing or transactional platform, its include goes in the same single record, not a second one.

No, and this surprises people. SPF validates the hidden envelope sender (Return-Path), not the From address displayed to recipients, so a spoofer can pass SPF for their own domain while showing yours in the From line. Closing that gap is exactly what DMARC does: it requires the SPF-validated domain to align with the visible From domain and lets you tell receivers to reject mail that fails. Publish SPF, then add DKIM and a DMARC policy. That trio is what actually stops spoofing.

v=spf1 -all: a record that authorizes nothing. Domains that send no email are favorite spoofing targets precisely because nobody is watching them, and mailbox providers explicitly recommend publishing a deny-everything SPF record on them. Tick the parked-domain option in the generator to get it, and pair it with a p=reject DMARC record for complete lockdown.

Not every service uses a shared SPF include anymore. Klaviyo, HubSpot, Mailchimp Transactional (Mandrill), Constant Contact, and SparkPost, for example, authenticate through CNAME records or account-specific values that their dashboard generates for you. Adding a generic include for them would do nothing. Check your provider's domain-authentication or DNS-settings page: if it gives you an include value, paste it into the Other includes field above; if it gives you CNAME records, publish those instead and leave SPF alone.

Run it through the SPF checker, which fetches the live record, validates the syntax, counts the DNS lookups, and flags problems like multiple records or unresolvable includes. Then send a test message to a Gmail address and use Show original to confirm spf=pass. For ongoing certainty across every sending service, DMARC aggregate reports show you SPF results as every receiver in the world sees them.