BYTETOOLS

SPF Record Generator

Create a valid SPF TXT record from your sending IPs, includes and mail servers — with live DNS-lookup counting against the 10-lookup limit. Free and private.

1 / 10
DNS lookups used (max 10)
31 chars
Record length (single TXT string max 255)

TXT record for example.com

v=spf1 mx ip4:203.0.113.25 ~all

Publish as a TXT record on example.com (host name @ at most DNS providers). A domain must have only one SPF record.

What is the SPF Record Generator?

The SPF Record Generator assembles a correct v=spf1 TXT value from the parts you actually control: your sending IPv4 and IPv6 addresses, third-party senders via include:, your own A and MX hosts, and the all qualifier that tells receivers what to do with everything else.

  • Builds a syntactically valid v=spf1 record from validated inputs
  • Live DNS-lookup counter against the hard limit of 10
  • Warns when the value exceeds the 255-character TXT string limit
  • ip4/ip6 mechanism support with CIDR ranges (no lookup cost)
  • Explains and discourages +all with an explicit warning
  • 100% client-side — no DNS queries, nothing uploaded

How to use the SPF Record Generator

  1. 1

    List the IPv4 and IPv6 addresses or CIDR blocks that send your mail.

  2. 2

    Add third-party senders as include: domains — e.g. _spf.google.com for Google Workspace.

  3. 3

    Tick a and mx if your web or mail hosts also send mail directly.

  4. 4

    Choose the all qualifier — ~all while testing, -all once the list is complete.

  5. 5

    Watch the lookup and length counters, then copy the TXT value into your DNS.

About the SPF Record Generator

The SPF Record Generator assembles a correct v=spf1 TXT value from the parts you actually control: your sending IPv4 and IPv6 addresses, third-party senders via include:, your own A and MX hosts, and the all qualifier that tells receivers what to do with everything else.

It watches the two limits that silently break real-world SPF records: the 10-DNS-lookup maximum (each include, a and mx costs one — exceed it and receivers return permerror) and the 255-character single-string limit for TXT values. Both are counted live as you build, with plain-English warnings.

Every entry is validated before it enters the record, and the whole tool runs 100% locally in your browser — it neither queries DNS nor sends anything anywhere. You copy the finished value and paste it into your DNS provider.

Frequently asked questions

What is an SPF record?

SPF (Sender Policy Framework) is a TXT record on your domain listing which servers may send email claiming to be from it. Receiving servers check the connecting IP against that list, which makes it much harder for spammers to forge your domain — and it is required alongside DKIM for DMARC to pass.

What is the SPF 10 DNS lookup limit?

Evaluating an SPF record may trigger at most 10 DNS lookups; include:, a, mx, ptr, exists and redirect each cost one, and nested includes count too. Go over and receivers return permerror, effectively disabling your SPF. ip4: and ip6: mechanisms are free, which is why listing IPs directly is the safest pattern.

Should I use ~all or -all?

~all (softfail) asks receivers to accept but mark suspicious mail, while -all (hard fail) asks them to reject it. Start with ~all while you confirm every legitimate sender is listed, then tighten to -all. Never use +all — it authorizes the whole internet and makes the record worse than none.

Can I have two SPF records on one domain?

No. RFC 7208 requires exactly one TXT record starting with v=spf1; two or more cause a permanent error at receivers. If you add a second sending service, merge its include into your existing record rather than adding a new one — this generator produces that single merged value.

Does an SPF record alone stop email spoofing?

Not fully. SPF checks the envelope sender, not the From header people see, and it breaks on plain forwarding. Pair it with DKIM signing and a DMARC policy to actually protect the visible From address — the DMARC generator on this site builds that companion record.

Does this tool query my DNS?

No. It builds and validates the record text entirely in your browser and never contacts a DNS server. Verifying what is currently published requires a DNS query tool; this generator's job is producing a correct value to publish.

Related tools