SPF Record Generator
Free SPF record generator and checker. Build or paste a record, count its DNS lookups against the limit of 10, and see every syntax error explained.
Updated
One per line, with an optional prefix length.
One per line, with an optional prefix length.
From your other providers' setup pages, one per line.
A record, quoted strings, dig output, or a zone file line.
For the zone file line and the size and loop checks.
Options
Another domain's record decides instead of the ending.
Domain whose TXT record explains failed checks.
To count every nested lookup live, use the email security checker.
Tick a sender, add an address or include, or tick This domain sends no mail.
What Is an SPF Record Generator?
The SPF record generator builds a Sender Policy Framework TXT record from provider presets, IP addresses and includes, and checks any record you paste. It parses the record with the RFC 7208 grammar, explains each term, counts the DNS lookups a receiver will make, and names every syntax error. Records longer than 255 characters are split into quoted strings ready for a zone file.
How to Use the SPF Record Generator
- Enter your domain (optional) and tick the services that send mail for it.
- Add your own mail server addresses and any other includes, then pick how unlisted servers are treated.
- Read the lookup count and the warnings, then copy the TXT value and publish it at your DNS host as a TXT record on the domain.
- To check an existing record, switch to Check a record and paste it, with or without the quotes from your DNS host.
How It Works
An SPF record is a TXT record on the domain of a message's MAIL FROM address, the address bounces go to. It lists the servers allowed to send mail for that domain. Receivers check the mechanisms from left to right, and the first one that matches the sending server's IP address sets the result: pass, fail, softfail or neutral. When nothing matches and there is no redirect, the result is neutral. A domain may publish only one SPF record.
The include, a, mx, ptr and exists mechanisms and the redirect modifier each cause a DNS lookup. Receivers allow at most 10 of them per check, counted across every nested include, and return permerror above that. The ip4, ip6 and all mechanisms and the exp modifier cost nothing. The generator counts the top-level terms exactly and adds the lookups inside each provider preset, counted through DNS on the date shown. For an include it has no preset for, it shows at least the count it knows.
Receivers should also stop after two void lookups, DNS answers with no records or for a name that does not exist. The generator does not query DNS, so it cannot count them.
A single TXT string holds at most 255 octets. A longer record is published as several strings in one TXT record, and receivers join them without adding spaces. The generator cuts after a space, so each string starts with a whole term. RFC 7208 advises keeping the DNS name and all its TXT records under 450 octets, so the DNS answer fits in a UDP packet.
Mechanism and modifier names are not case-sensitive. A syntax error anywhere in the record, even after all, makes receivers return permerror without evaluating the record, so the checker reports every error it finds. Unknown modifiers are ignored, terms after all are never evaluated, and redirect is ignored when the record has an all mechanism.
Mechanisms and Modifiers
| Term | Meaning | DNS lookups |
|---|---|---|
| all | Matches every sender. Written last, it sets the result for unlisted servers. | 0 |
| include:<domain> | Checks the SPF record of <domain> and matches when that record gives the sender pass. | 1, plus those in its record |
| a[:<domain>][/n] | Matches when the sender's IP address is an address (A or AAAA record) of <domain>, or this domain when omitted. | 1 |
| mx[:<domain>][/n] | Matches when the sender's IP address is an address of one of the mail servers (MX records) of <domain>, or this domain when omitted. | 1 |
| ptr[:<domain>] | Matches when the sender's IP address has a validated reverse DNS name under <domain>, or this domain when omitted. | 1 |
| ip4:<network>[/n] | Matches senders whose IP address is in <network>/n. | 0 |
| ip6:<network>[/n] | Matches senders whose IP address is in <network>/n. | 0 |
| exists:<domain> | Matches when an A record exists for <domain>, after its macros are expanded. | 1 |
| redirect=<domain> | When no mechanism matches, the result comes from the SPF record of <domain> instead. | 1, plus those in its record |
| exp=<domain> | On fail, receivers may return an explanation built from the TXT record at <domain>. | 0 |
Qualifiers
| Qualifier | Result | Meaning |
|---|---|---|
| + | pass | An explicit statement that the server is authorized to send with the domain. The default when no qualifier is written. |
| - | fail | An explicit statement that the server is not authorized to use the domain. |
| ~ | softfail | A weak statement that the server is probably not authorized. |
| ? | neutral | The domain owner states nothing about the server. Receivers treat it exactly like no SPF record. |
Provider Presets
| Provider | Include | Lookups | Counted | Source |
|---|---|---|---|---|
| Google Workspace | _spf.google.com | 1 lookup | 2026-11-08 | Setup guide |
| Microsoft 365 | spf.protection.outlook.com | 1 lookup | 2026-11-08 | Setup guide |
| SendGrid | sendgrid.net | 2 lookups | 2026-11-08 | Setup guide |
| Mailgun | mailgun.org | 5 lookups | 2026-11-08 | Setup guide |
| Amazon SES (custom MAIL FROM domain) | amazonses.com | 1 lookup | 2026-11-08 | Setup guide |
Standard
Scope
What It Checks
- +Builds an SPF record from provider presets, IPv4 and IPv6 addresses, the a and mx mechanisms, custom includes, redirect and exp.
- +Checks a pasted record with the RFC 7208 grammar and names every syntax error, including errors after all.
- +Counts the DNS lookups a receiver makes, including the lookups inside each provider preset, and warns at and above the limit of 10.
- +Warns about +all, ?all, a missing all, terms after all, an ignored redirect, ptr, duplicate terms, and addresses with host bits set.
- +Splits records longer than 255 characters into quoted strings that join back to the same record.
- +Reads records copied from dig, a zone file, or a DNS dashboard, and reports more than one SPF record.
What It Does Not Check
- -It does not look anything up in DNS, so it cannot count the lookups inside an include it has no preset for, or void lookups.
- -It does not check whether the listed servers really send your mail.
- -It does not test a sending IP address against the record.
- -It does not publish the record. You add it at your DNS host.
Defensive Use
SPF lets a domain owner publish which servers may send mail for the domain used in the MAIL FROM address, and receivers check it on every message. A record with no permitted senders, v=spf1 -all, marks a domain that sends no mail, which the UK National Cyber Security Centre advises for parked domains because unprotected ones can be used for spoofing and phishing.
Frequently Asked Questions
What is an SPF Record Generator?→
The SPF record generator builds a Sender Policy Framework TXT record from provider presets, IP addresses and includes, and checks any record you paste. It parses the record with the RFC 7208 grammar, explains each term, counts the DNS lookups a receiver will make, and names every syntax error. Records longer than 255 characters are split into quoted strings ready for a zone file.
What is the SPF Record Generator used for?→
Writing the first SPF record for a domain, adding a new email provider to an existing record, and finding out why a record fails with permerror or goes over the limit of 10 DNS lookups.
Is my data sent anywhere?→
No. The SPF Record Generator runs in your browser. What you enter stays on this page and is not sent to ImmunitySec or anyone else.
How is the SPF Record Generator used defensively?→
SPF lets a domain owner publish which servers may send mail for the domain used in the MAIL FROM address, and receivers check it on every message. A record with no permitted senders, v=spf1 -all, marks a domain that sends no mail, which the UK National Cyber Security Centre advises for parked domains because unprotected ones can be used for spoofing and phishing.
What is the difference between ~all and -all?→
-all gives unlisted servers fail, an explicit statement that they are not authorized to use the domain. ~all gives softfail, a weak statement that they are probably not authorized. Google's SPF setup page uses ~all, and Microsoft's example record uses -all. ?all gives neutral, which receivers must treat exactly like no SPF record.
Why is there a limit of 10 DNS lookups?→
RFC 7208 limits the include, a, mx, ptr and exists mechanisms and the redirect modifier to 10 per check, to avoid unreasonable load on the DNS. The limit counts every lookup in every nested include, not just the terms in your own record. Above 10, receivers return permerror.
Can a domain have two SPF records?→
No. A domain must not publish records that would make a receiver select more than one SPF record, and when it does, the check returns permerror. Merge the terms of both records into one.
What is a void lookup?→
A DNS query that returns an answer with no records, or a name error for a name that does not exist. RFC 7208 says receivers should allow at most two void lookups per check, and going over the limit produces permerror.
My SPF record is longer than 255 characters. What do I do?→
Publish it as several quoted strings in one TXT record. Receivers treat the strings as if they were joined without adding spaces, so the record works the same. The 255-octet limit applies to each string, not to the whole record.
Do I need an SPF record on a domain that sends no mail?→
The UK National Cyber Security Centre advises it for parked domains: an SPF record with no permitted senders, v=spf1 -all, which says no IP address is authorised to send mail for the domain. It pairs this with a DMARC policy of reject.
Does SPF check the From address people see?→
No. SPF checks the MAIL FROM address of the SMTP session, the address bounces go to. DMARC relies on SPF only for the MAIL FROM identity, and counts an SPF pass only when that domain aligns with the From domain.
Mechanism meanings, limits and result names come from RFC 7208. Each provider include comes from that provider's own setup documentation, and the lookups inside it were counted through DNS on the date shown with the preset.