Skip to content
Sign inGet started
Help · MoreSPF record generator: one record for every sender
Start here

SPF record generator: one record for every sender

Tick the services that send mail as your domain and copy the one SPF record to add. It counts the DNS lookups as you go, so you stay under 10. Free.

On this page · 6 sections
Services that send as your domain
More options
TypeTXTName@Valuev=spf1 include:_spf.mx.cloudflare.net ~allDNS lookups1 of 10

Adding the record

  1. In your DNS provider (on Cloudflare: DNS → Records), look for a TXT record on the domain itself that starts with v=spf1.
  2. If there is one, edit it and replace its value with the generator's. A domain must have only one SPF record: with two, SPF fails with permerror. [1]
  3. If there isn't, choose Add record, type TXT, name @ (the domain itself), and paste the value.
  4. Check it with the email DNS checker, then send yourself a message at Gmail and open Show original: it says SPF: PASS or the error.

What each part means

v=spf1
What it does: Says this TXT record is SPF. It must come first. [1]
DNS lookups: 0
include:
What it does: Lets the servers named in another domain's SPF record send for you. This is how you allow a service like Google Workspace or Mailchimp. [1]
DNS lookups: 1, plus everything inside it
a, mx
What it does: Lets the servers your domain's A or MX records point to send. Only add them if those servers really send mail. [1]
DNS lookups: 1 each
ip4:, ip6:
What it does: Lets one address or range send, such as your own server. [1]
DNS lookups: 0
~all, -all, ?all
What it does: What to say about mail from anywhere else: soft fail, fail or neutral. It goes last. [1]
DNS lookups: 0

~all or -all?

-all says mail from any other server fails SPF, and ~all says it soft fails: probably not allowed, but don't reject it on SPF alone. [1] Most domains start with ~all while they make sure every sender is listed, and pair it with a DMARC record. Use -all once you're sure every service that sends as you is listed. Never use +all: it lets anyone send as your domain.

A domain that never sends mail, such as one parked for a future project, should still publish v=spf1 -all, which says no server may send for it.

The two limits

  • 10 DNS lookups. Every include, a, mx, ptr, exists and redirect costs one, and so does every one of those inside the includes. Past 10, SPF fails with permerror. [1] The generator adds up the costs as you tick; SPF too many DNS lookups? has the ways to get back under.
  • 255 characters per string. One TXT string holds at most 255 characters. A longer record is published as several strings in the same TXT record, and receivers join them back together without adding spaces. [1] Many DNS providers split it for you.

Or let Ayoh add it

Ayoh sends through Cloudflare Email Service, so it needs only include:_spf.mx.cloudflare.net, one lookup. When you connect a domain, Ayoh adds it to the SPF record you have instead of creating a second one. The rest of the records are in SPF, DKIM and DMARC on Cloudflare, and the DMARC record generator writes the DMARC one.

Sources

Read November 11, 2026.

  • [1] IETF, RFC 7208, SPF (opens in a new tab): one record per domain (section 3.2), several strings in one record (section 3.3), mechanisms and qualifiers (sections 4.6 and 5), the limit of 10 lookups (section 4.6.4).
PreviousDMARC record generator: build yours step by stepNextCloudflare catch-all email: setup and when not to