Generator · RFC 7208 · live check

SPF generator

Tick the services that send mail for your domain. You get the SPF record ready for DNS, checked live: the DNS lookups, the length and what the domain publishes now.

01The domain optional

Domain

With the domain, the form can start from the current record (the button beside it), a and mx can be used and the DNS lookups are counted exactly.

02Who sends mail for the domain

Google Workspaceinclude:_spf.google.com
Microsoft 365include:spf.protection.outlook.com
Zoho Mailinclude:zohomail.com
The website's server (the A/AAAA addresses)a
The domain's MX serversmx

Bulk sending services each have their own rules: some use their own return address, so your domain's SPF does not change for them (Amazon SES, for example, asks for SPF only for a custom MAIL FROM domain, a subdomain). Follow the service's instructions; if it gives you an include:, add it in step 3.

03Other servers optional

IP addresses or networks of your own servers

Other includes, given by services

04What happens to every other server

~all softfail: mail from other servers is suspect (Google's recommendation) -all fail: mail from other servers is not authorised (Microsoft's recommendation, with DKIM and DMARC)

v=spf1 -all The domain sends no mail at all (Microsoft recommends this for parked domains)

Live preview

@TXT

v=spf1 ~all

DNS lookups 0/10

Only the terms written here; nested includes are counted by the check.

Length 11/255

ip4 / ip6no DNS lookups
include · a · mxat least one lookup each
~all-allwhat happens to the rest

The full check, with DNS, runs when you generate.

Examples: Google Workspace Microsoft 365 and an own server A domain that sends no mail

SPF in short

What it does
SPF (RFC 7208) says which servers may send mail for a domain. It checks the domain of the return address (MAIL FROM), not the one in From (section 2.4); that is why a service sending with its own return address needs no include in yours.
~all or -all
~all (softfail) marks mail from other servers as suspect, -all (fail) declares it unauthorised. Google recommends ~all; Microsoft recommends -all when the domain has DKIM and DMARC. For DMARC, both mean SPF failed.
The 10-lookup limit
Evaluation may make at most 10 DNS lookups: every include, a, mx, exists and redirect counts, including those inside includes; ip4, ip6 and all do not (RFC 7208 section 4.6.4). Past the limit the result is permerror.
One record
A domain has one SPF record (RFC 7208 section 3.2). If you use several services, put them all in the same record; a second one would break evaluation.

Sources: Google Workspace · Microsoft 365 · Zoho Mail · RFC 7208

Email DNS records: MX, SPF, DKIM and DMARC explained