Free tool

SPF Record Generator

Select your email services, add your sending IPs, and get a ready-to-publish SPF record — with a live 10-lookup counter so you never break deliverability.

include

Email services 1 lookup each

Select every service that sends email on behalf of your domain. Each include: costs one DNS lookup — you have a budget of 10 total. Exceeding it causes SPF to permanently fail for that domain.

include

Custom include

Add any other domain whose SPF record should authorise your senders. Each entry costs one DNS lookup. Enter the domain only — no include: prefix needed.

ip4 / ip6

IP addresses no lookup cost

Add specific IP addresses or CIDR ranges allowed to send email for your domain. IPv4 (e.g. 203.0.113.5 or 203.0.113.0/24) and IPv6 (e.g. 2001:db8::/32) are both supported. These don't consume any DNS lookups.

a / mx

Server mechanisms 1 lookup each

a authorises the IPs in your domain's A record — use this if your web server also sends email. mx authorises your incoming mail servers — use this only if those servers also send outbound email. Both cost one DNS lookup each.

a Authorise this domain's A record IPs. mx Authorise this domain's MX servers.

all

Final policy required

What receivers should do with email from senders not covered by any mechanism above. This is the catch-all at the end of the record — everything that didn't match anything else ends up here.

~all — softfail Unlisted senders are marked suspicious but still delivered. Safe starting point while you confirm all your senders are covered. -all — hardfail Unlisted senders are rejected outright. Use only when you're confident every legitimate sender is covered above. ?all — neutral No recommendation — receivers decide. Rarely useful; use softfail instead if you're still testing.

Check domain health score

DMARC, SPF, DKIM — instant security grade

DMARC Record Generator

Set your enforcement policy and reporting addresses

Your DNS record

Add as a TXT record at yourdomain.com (root — not a subdomain)

v=spf1 ~all

DNS lookups 0 / 10

No lookup-based mechanisms added yet.

How to install

Log in to your DNS provider (Cloudflare, Namecheap, cPanel…)
Create a new TXT record
Set Name / Host to @ (root of your domain)
Paste the record above as the Value
Set TTL to 3600 (1 hour)
Save — allow up to 48 h for propagation
Run a domain check to verify it's live