SPF record generator

Build the SPF record for your domain. Tick the services that send email for you, add any of your own servers, and copy the finished TXT record. It counts the DNS lookups as you go, so you stay under SPF's limit of 10.

TXT

@

v=spf1 ~all

How this generator works

SPF (Sender Policy Framework) is a TXT record on your domain listing the servers allowed to send email as you. Receiving servers check it against the server that actually sent each message. The generator puts the record together from what you tick:

• v=spf1 starts every SPF record.
• mx and a allow the servers your MX and A records point to.
• ip4: and ip6: allow single addresses or ranges.
• include: pulls in another service's SPF record, so when Microsoft or Google change their servers you don't have to.
• ~all, -all or ?all at the end says what to do with email from anywhere else.

It also counts DNS lookups. The SPF standard (RFC 7208) lets a receiver make at most 10 DNS lookups while checking your record, counting every include, a, mx, ptr, exists and redirect, including the ones inside the services you include. Go over 10 and SPF returns a "PermError", which counts as a fail, so email from every service on the list can start going to spam. IP addresses don't use any lookups.

Over the limit? Flattening and other fixes

If you're over 10, try these in order:

1. Remove services you no longer use. Old newsletter tools and previous email hosts are the usual culprits.
2. Send bulk email from a subdomain. Marketing tools can usually send from something like news.example.co.uk, which has its own SPF record and its own 10 lookups.
3. Drop mx and a if those servers don't actually send email.
4. Flatten as a last resort. Flattening replaces an include with the IP addresses it currently resolves to, so it uses no lookups. The catch is that when the provider changes its addresses your record goes out of date and their email starts failing, so it needs checking regularly or a service that does it automatically.

Our guide to fixing "too many DNS lookups" goes through each step in detail.

Common provider includes

Tips

• Publish one SPF record only. If your domain has two TXT records starting v=spf1, SPF fails for all your email. Merge them: paste both into "Import" above and it combines them.
• Never use +all. It allows every server on the internet to send as you, which defeats the point.
• Don't use ptr. The standard says not to: it's slow, unreliable and some receivers ignore it.
• SPF alone isn't enough. Set up DKIM in each service too, then add a DMARC record with the DMARC record generator so receivers know what to do with email that fails.
• Domains that never send email should have v=spf1 -all, which says no server may send for them. Untick everything here to get it.
• Check it once it's live with the email DNS checker, which follows every include and gives the real lookup count, or see all your TXT records with the DNS lookup.

Frequently asked questions