Get started ->
FREE TOOL

Free SPF Record Generator

Tick the services that send email for your domain and get one SPF record to publish, with the lookup count as you go. If your domain already has SPF, we start from it. No sign-up.

Optional. We read the domain's current SPF record once and fill the form from it, so you add to it instead of replacing it by accident.

Where do you send email from?

SendGrid, Postmark, SparkPost need no include on your main domain: their docs check SPF on their own return-path domain. Set them up with the DKIM and return-path records they give you.

Your own servers

One per line or separated by commas. Copy an include from your provider's setup page; addresses cost no lookups.

What should happen to everything else?

Your SPF record

Type
TXT
Host
@

Some DNS providers want the domain name or an empty host instead of @.

Value

v=spf1 -all

DNS lookups, at least

0 / 10

Includes can add lookups of their own. The SPF checker shows the full count after you publish.

  • Nothing is selected, so this record says the domain sends no email at all. That is right for a domain that never sends; otherwise tick the services you use.

Replace, do not add. If the domain already has a record starting with v=spf1, edit it and paste this value. Two SPF records break SPF for the whole domain.

Check after publishing ->

What this builds

An SPF record is one TXT record on your domain that lists every server allowed to send email as that domain. Receiving servers look it up and compare the sending server with the list. This generator writes that record for you: tick the services you send with, add your own servers if you have any, pick how strict the ending is, and copy the result.

Everything is built in your browser. If you type a domain that already has SPF, the page asks our checker for the current record once and fills the form from it, so you add to what is there instead of starting over.

One record, not two

A domain may have exactly one SPF record. When a second service asks you to "add an SPF record", it means add its include: to the record you already have. Two records starting with v=spf1 make receivers return a permanent error, and your mail fails SPF everywhere. Publish the value from this page in place of the old record.

If your domain has two records today, type the domain: the generator reads both and builds one record with every sender from each.

Services that need no include

Some services check SPF against their own return-path domain, not yours, so their documentation says an include: on your main domain does nothing for them and only costs a lookup. You set them up with the DKIM and return-path (CNAME) records they give you instead: SendGrid (with automated security on), Postmark and SparkPost. For any other service, follow its own setup page.

Ackuna is listed with include:amazonses.com because that is the record the Ackuna console gives you for a sending domain. It costs one lookup.

The 10-lookup limit

Each include:, a, mx and exists: costs a DNS lookup, and an include can pull in more lookups of its own. SPF allows 10 in total; above that the whole record fails. The generator counts the lookups the record itself needs, which is the minimum. After you publish, run the SPF checker to see the full count with every nested include. ip4: and ip6: entries are free.

How to publish it

  1. Copy the value from the result box.
  2. Open your DNS provider (Cloudflare, GoDaddy, Namecheap, Route 53, your registrar…) and find the TXT records of your domain.
  3. Edit the existing SPF record if there is one, and replace its value. Otherwise add a TXT record with host @ (some providers want the domain name or leave the host empty).
  4. Save and wait for DNS to update, usually a few minutes to an hour.
  5. Check it with the SPF checker. The "Check after publishing" button opens it with your domain filled in.
Related pages
SPF Record CheckerRead more ->DMARC Record CheckerRead more ->Email DNS CheckRead more ->SMTP setup guidesRead more ->
FAQ

SPF generator questions

Can I have two SPF records?

No. The standard allows one TXT record starting with v=spf1 per domain. With two, receivers return a permanent error and treat SPF as failed. Merge every service into one record; this generator does it for you.

Should I end the record with ~all or -all?

Start with ~all (soft fail): mail from servers you forgot is marked, not refused. Once you are sure every service that sends as your domain is in the record, and DMARC reports show nothing legitimate failing, switch to -all. Never use +all, which lets any server on the internet send as you.

What if my domain sends no email at all?

Leave everything unticked. The generator gives you v=spf1 -all, which tells receivers that no server may send as this domain. It is a good record for parked domains and domains used only for a website.

Why is my provider not in the list?

The list has popular services whose documentation gives one include for your main domain; each was checked against that documentation and against DNS. For anything else, copy the include from your provider's setup page into "Other includes". Some providers need no include at all; see "Services that need no include" above.

Why does the record leave out ptr?

The SPF standard (RFC 7208) says not to use the ptr mechanism: it is slow, unreliable and some receivers ignore it. If your current record has it, the generator drops it and tells you.

Does Ackuna store what I enter?

No. The record is built in your browser. If you type a domain, the page looks up its current SPF record once through our checker, which keeps the answer for five minutes and does not log the domain.

Start sending in minutes

All three services free every month: 2,500 newsletter, 3,000 relay and 3,000 Agent Mail emails. No credit card required - upgrade only when your volume does.

Create free account ->Talk to sales