How to Create an SPF Record Without Breaking Email

✉️Free SPF Record Generator
Build an SPF record for the services that send your email.Open tool →

Anatomy of an SPF record

A typical record looks like: v=spf1 include:_spf.google.com include:servers.mcsv.net ~all. It starts with v=spf1, lists approved senders, and ends with a rule for everyone else.

include: approves another provider's servers. ip4: and ip6: approve specific addresses. mx approves the servers that receive your mail, and a approves your website's server.

Build yours

Write down every service that sends email with your domain in the From address. Tick them in the SPF Record Generator, add any extra server IPs, and copy the result.

Add it as a TXT record at the root of your domain (host @). If an SPF record already exists, edit it – never add a second one.

The 10-lookup limit

Each include, a and mx costs a DNS lookup, and providers' own records may use more. Above 10, SPF returns a permanent error and fails for all your mail. Remove services you no longer use, and replace includes with ip4 ranges only if the provider publishes stable addresses.

~all or -all

~all marks other senders as suspicious; -all tells receivers to fail them outright. With a DMARC policy in place the practical difference is small, so ~all is the safer default.

Frequently asked questions

Where do I find my provider's SPF value?

In its help pages under 'SPF' or 'email authentication' – or tick it in the generator.

How do I check my SPF record?

Run your domain through the Email Spoofing Checker.

Does SPF stop spoofing on its own?

No. Pair it with DKIM and DMARC.