SPF record generator
Tick the services that send email on your behalf (Microsoft 365, Google Workspace, Mailchimp…): your SPF record is ready, with a DNS lookup count.
v=spf1 -all
Direct DNS lookups: 0 / 10. Each include may consume more: beyond 10 in total, SPF fails.
No sender selected: “v=spf1 -all” states this domain never sends email. Ideal for an unused domain.
Only one SPF record per domain: replace the old one, don’t add a second. Confirm each include in your provider’s documentation.
Before you publish
- Take inventory: email platform, newsletters, invoicing software, CRM, website, multifunction printer that emails scans.
- Replace the existing record rather than adding a second one.
- Check the result with our checker, then enable DKIM at each provider.
SPF alone doesn’t stop spoofing of the visible address: that is DMARC’s job. Complete it with our DMARC generator.
Frequently asked questions
Can I have two SPF records?+
No. A domain must publish only one record starting with v=spf1; with two, the check fails (permerror). Merge all your senders into a single record.
-all or ~all?+
-all rejects unlisted senders; ~all marks them as suspicious. With an enforced DMARC policy ~all is acceptable, but -all is clearer once your list is complete.
What is the 10 DNS lookup limit?+
The include, a, mx, exists and redirect mechanisms each trigger DNS queries. Beyond 10 in total (including nested includes), SPF fails. Remove services you no longer use.