SPF recordgenerator.
Pick the services that send email for your domain and get one valid SPF record to publish, with a warning before you reach the 10-lookup limit.
How it works
- Pick your sendersGoogle, Microsoft, your CRM, your tools
- Copy the recordOne TXT record for your domain
- Publish itReplace any old SPF record
Free, no sign-up. Runs in your browser. Nothing you type is sent anywhere.
The tool
What sends email for you?
Pick every service that sends from this domain. Anything you leave out will fail SPF.
The include: value from that service's DNS instructions.
Your SPF record
Add it as one TXT record on your domain's root (@). Replace any SPF record already there.
v=spf1 include:_spf.google.com ~all
Four rules that break SPF
- One SPF record per domain. Two v=spf1 records make SPF fail.
- At most 10 DNS lookups, counting includes inside includes.
- Never +all: it lets anyone send as you.
- SPF alone isn't enough: pair it with DKIM and DMARC.
Getting SPF right.
What the result means, and how to fix what it finds.
What SPF does
SPF is a list of the servers allowed to send email as your domain. When your email arrives, the receiving server looks up your domain's SPF record and checks that the sending server is on it. If it isn't, the email fails SPF, and with DMARC in place that can send it to spam or get it rejected.
Include everything that sends
Your mailbox provider first (Google Workspace or Microsoft 365), then anything else that sends as your domain: your CRM, help desk, newsletter tool or invoicing system. A service you leave out starts failing the day you publish. For a domain used only for cold email, that's usually just your mailbox provider.
Only one record, and only 10 lookups
A domain may have only one SPF record. If you already have one, merge the senders into it instead of adding a second, because two records make SPF fail outright. Each include costs at least one DNS lookup, includes inside includes count too, and past 10 receivers treat SPF as failed.
Which ending to choose
~all (softfail) tells receivers to treat unlisted senders as suspicious; -all (hardfail) tells them to reject. For cold email domains ~all is the safer choice: it protects you with DMARC in place without bouncing mail from a sender you forgot to add. Never use +all, which lets anyone send as you.
Common SPF mistakes
The most common mistake is a second v=spf1 record added by a new tool's setup guide, which breaks SPF for everything. Next is a typo in an include, such as a missing underscore in _spf.google.com, which fails silently. Some people list their website's IP address, which only matters if the website itself sends email. Others use ptr, which is slow and discouraged; leave it out. Finally, SPF only checks the hidden return address, not the From address people see, which is why DMARC is needed to tie the two together. After publishing, check the record with our Domain Health Checker and send a test email to a Gmail address to see SPF pass in the headers.
In mailzy
Mailboxes with SPF, DKIM and DMARC set up for you.
Order Google Workspace mailboxes from mailzy and we publish every record on your domain, then warm the mailboxes up.
Questions before you start.
Ask us on the chat if yours isn't here. A real person answers.
Where do I add the SPF record?
At your domain registrar or DNS host, as a TXT record on the root of the domain (often written as @). Remove any older v=spf1 record so only one remains.
Do I need SPF if I use Google Workspace?
Yes. Google sends for you, but receivers only trust it if your SPF record includes Google: include:_spf.google.com.
How long until it works?
Usually within an hour, sometimes up to a day. Check it with our Domain Health Checker.
More free tools.
Domain Health Checker
One score for a sending domain: SPF, DKIM, DMARC, MX, blocklists and Gmail's and Yahoo's sender rules.
Open the toolDKIM Checker
Check that a DKIM key is published, that it parses, and that it's long enough.
Open the toolDMARC Record Generator
Create a DMARC record with the right policy and report address, with every tag explained.
Open the toolEverything for cold email, in one place.
Start free for 14 days. No card needed.