SPF Record Generator
Build an SPF TXT record from your mail providers, IPs and servers with the DNS lookup count checked, or paste an existing SPF record to have every part explained.
Each include also counts the lookups inside it (Google Workspace's include currently uses several), which this page cannot resolve. Check the total stays at 10 or fewer.
Publish exactly one SPF record per domain — two v=spf1 records make SPF fail. Merge any existing record into this one.
Provider include values were checked against their help pages in November 2026; use the value your provider's admin console shows if it differs.
SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send mail for your domain. This generator builds the record from the mail services you use — Google Workspace, Microsoft 365, Amazon SES, SendGrid, Mailgun, Mandrill, Brevo, Zoho, NAVER WORKS — plus your own IP ranges and servers, and counts the DNS lookups against SPF's limit of 10. Paste an existing record instead to have each part explained and checked for errors.
How to use this tool
- Enter your domain and tick every service that sends mail as you (newsletters, help desk, invoices).
- Add your own servers' IP ranges or other include domains.
- Choose ~all (soft fail) or -all (fail) for everything else.
- Publish the TXT value at the domain itself (host @), replacing any older SPF record.
Formula
v=spf1 [a] [mx] [ip4:…] [ip6:…] [include:…] (-all | ~all | ?all)
Terms are tested left to right and the first match decides; "all" catches everything else. include, a, mx, ptr, exists and redirect each cost one DNS lookup, and the total — counting lookups inside included records — must not exceed 10 (RFC 7208 §4.6.4). ip4 and ip6 cost nothing.
Example
A company using Google Workspace and Microsoft 365 that wants unlisted senders rejected publishes v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all — 2 lookups in the record itself. Explaining v=spf1 ip4:192.0.2.0/24 include:_spf.google.com mx ~all shows 4 terms, 2 lookups and a soft fail for everything else.
Frequently asked questions
-all or ~all?
~all (soft fail) asks receivers to accept but mark unlisted mail; -all asks them to reject it. With DMARC published, receivers mostly act on the DMARC policy, so both work. ~all is the gentler choice if some of your mail is forwarded, because a few receivers reject a hard fail before DMARC is checked.
Why "too many DNS lookups"?
Every include can contain more includes. If the chain needs more than 10 lookups, SPF returns a permanent error and fails for everyone. Remove unused services or use ip4/ip6 ranges where a provider publishes them.
Can I have two SPF records?
No. Two v=spf1 records on the same name make SPF fail. Combine all senders into one record.
Sources
Last updated:
Page address with these inputs: https://kakao.mobile/tools/spf-record-generator/
Cite or embed this tool
kakaoCalc. (2026, November 8). SPF Record Generator. https://kakao.mobile/tools/spf-record-generator/
“SPF Record Generator.” kakaoCalc, 8 Nov. 2026, kakao.mobile/tools/spf-record-generator/.
Paste this code into your page. The widget runs in your visitors' browsers, shows no ads and keeps a link back to this page. Embedding terms