Free DNS ToolBuild a valid SPF record by selecting your email sources, allowed servers, and providers. Copy the generated DNS TXT record and add it to your domain in minutes.
FAQEverything you need to know about creating, publishing, and maintaining SPF records for your domain, from setup to lookups.
An SPF (Sender Policy Framework) record is a DNS TXT record that lists the mail servers and services authorized to send email on behalf of your domain. Receiving servers check this record to verify that incoming mail from your domain comes from an approved source, which helps block spoofing and improves deliverability.
Choose whether to allow your domain's MX servers and A record, then enter the IPv4 or IPv6 addresses, hostnames, and email providers (as include values) that send mail for you. Finally, pick how strictly unauthorized senders should be treated, and the tool assembles everything into a valid v=spf1 TXT record you can copy straight into your DNS.
Add it as a TXT record on your root domain (for example, yourdomain.com) in your DNS provider's dashboard. Use "@" or your domain name as the host, paste the generated record as the value, and save. Changes usually propagate within minutes, though they can take up to 48 hours.
• Neutral (?all): for testing only, unauthorized mail is neither accepted nor rejected. • Soft fail (~all): recommended for most domains, unauthorized mail is marked as suspicious but not rejected. • Hard fail (-all): the strongest protection, switch to this once you're certain every legitimate sending source is included.
During validation, SPF allows a maximum of 10 DNS lookups per check, counting mechanisms such as include, a, mx, and redirect. Exceeding this limit causes a permanent error (permerror) and your record may be ignored. Keep your record lean by listing IP addresses directly instead of nesting includes.
No. A domain must have exactly one SPF record. If multiple v=spf1 records exist, the record is treated as invalid. If you already have an SPF record, merge the new sending sources into it rather than adding a second record.
Not on its own. SPF only validates the envelope sender (Return-Path), not the From address recipients see, and it can break when email is forwarded. For complete protection, pair SPF with DKIM, which signs your messages, and DMARC, which ties the results to your visible From domain and defines what happens on failure. You can use our DMARC Record Generator to set that up.
After publishing, use a DNS lookup tool to confirm your domain returns exactly one TXT record starting with v=spf1. Then send yourself a test email and check the Authentication-Results header for spf=pass, or run your message through our free Mail Tester to review your full authentication score.
