SPF record generator
Tick every service that sends email as your domain and get a single, valid SPF record, with the DNS lookup count and warnings before you publish. Or load your current record and edit it.
SPF RECORD GENERATOR
Loaded the current SPF record of proton.me: v=spf1 include:_spf.protonmail.ch ~all
1. Who sends email as your domain?
Email inbox providers
Newsletters and sending services
Apps and stores
2. Your own servers (optional)
3. What should happen to everyone else?
YOUR SPF RECORD
v=spf1 include:_spf.protonmail.ch ~all
| Type | Host / Name | Value | TTL |
|---|---|---|---|
| TXT | @ | v=spf1 include:_spf.protonmail.ch ~all | 3600 |
Replace your existing SPF record instead of adding a second one: two SPF records break SPF. After publishing, check it here (this counts the nested lookups, too).
How an SPF record is built
An SPF record is one line of text starting with v=spf1, followed by the senders you allow and ending with a rule for everyone else. For a Google Workspace user who also sends a newsletter with Brevo: v=spf1 include:_spf.google.com include:spf.brevo.com ~all.
- include: trusts another service's own SPF list. This is how you add Google, Zoho or a newsletter tool.
- ip4 / ip6: a specific server or range, for your own mail server or a VPS.
- a / mx: the server your domain points to, or your mail servers.
- ~all / -all: what happens to everyone else.
~allplus DMARC is the safe default;-allis stricter.
Mistakes this generator prevents
- Two SPF records. Adding a new record for each service is the classic error. There must be exactly one; this builds one with everything in it.
- More than 10 lookups. We count the includes as you tick them. Big providers use nested includes (Google's uses 4 lookups on its own), so check the published record with the checker.
- Forgetting a sender. Your website's contact form, your store and your help desk may all send as your domain. List them all.
Moved your email recently?
If your old host also handled email (cPanel email at HostGator or Bluehost, for example), its SPF include stops being needed once mail moves. Remove it after the switch, or it keeps using up lookups.
FAQ
What is an SPF record?
A TXT record on your domain that lists which servers may send email as you. Receivers check it to spot forged mail.
Where do I add the SPF record?
In the DNS settings of whoever runs your DNS (your registrar, Cloudflare or your host): add a TXT record with host "@" and the record as the value. If an SPF record already exists, edit it instead of adding another.
Should I use ~all or -all?
Use ~all with a DMARC policy; DMARC then decides what happens to failing mail. Use -all if you are sure every sender is listed, or for domains that never send email.
How many includes can an SPF record have?
There is no fixed number of includes, but the whole record may trigger at most 10 DNS lookups, including the lookups inside each include. In practice that's 3 to 6 services.
What SPF record should a domain that doesn't send email have?
"v=spf1 -all". Untick everything above and choose Fail (-all).
CHANGING HOSTS?
DNS is where most migrations go wrong. Follow the hosting switch checklist, lower your TTL a day before, and use the propagation checker after the switch. Comparing new hosts? See real renewal prices.