Worked example
v=spf1 ip4:192.0.2.10 include:_spf.example.net -all authorizes two sources and hard-fails everything else.
SPF Record Generator
Sender Policy Framework (SPF) records tell receiving mail servers which IP addresses and domains are authorized to send email on behalf of your domain. Use this builder to generate a valid v=spf1 TXT record.
Build Your Record
A Records
Allow any IP address the domain's A record points to.
MX Records
Allow any IP address the domain's MX records point to.
Specific IPv4 addresses or CIDR blocks allowed to send mail. Separated by commas.
Specific IPv6 addresses or CIDR blocks allowed to send mail.
Third-party domains authorized to send mail (e.g., Google Workspace, Microsoft 365).
The
all mechanism defines what to do with mail from sources not listed above.SPF FAQ
What is v=spf1?
This is the version tag. It must be at the very beginning of the TXT record. Currently, only v=spf1 is valid and used.
Qualifiers (+, -, ~, ?)
- + (Pass): Explicitly allow. (default if omitted)
- - (Fail): Explicitly reject. Use this for the most secure policy once you are sure all sources are listed.
- ~ (SoftFail): Mark as suspicious but deliver. Recommended during setup or for most domains to prevent accidental rejection of legitimate mail.
- ? (Neutral): No recommendation. Effectively does nothing.
The 10 DNS Lookup Limit
The SPF specification limits the number of DNS lookups to 10 to prevent Denial of Service attacks. include, a, mx, ptr, and exists mechanisms all count toward this limit. ip4 and ip6 do not.
How to use SPF Generator
Select authorized mail sources to assemble an SPF TXT record with explicit mechanisms and a final policy.
Common mistake
SPF permits at most ten DNS-causing lookups during evaluation and multiple SPF records create a permanent error.