SPF record generator

Emails going to spam, or your email provider says “add an SPF record”? Tick every service that sends email using your domain, press Create my SPF record, and copy the one line it gives you into your DNS. Type your domain too and we’ll read your current record first, so nothing that already works gets dropped.

Your domain (optional but recommended)

Email Microsoft 365 / Outlook (business email) Google Workspace / Gmail with your domain Zoho Mail Proton Mail Fastmail iCloud Mail with your domain (uses 5 lookups) Mimecast (South African account) Mimecast (other regions) (uses 9 lookups)

Website My website server (contact forms, WordPress, online shop on normal hosting) My own mail server (the server in my MX records) Shopify (order emails)

Newsletters Mailchimp (newsletters) Mailchimp Transactional (Mandrill) Brevo (Sendinblue) MailerLite Constant Contact Campaign Monitor Mailjet SendPulse

Apps & developers SendGrid Mailgun (uses 5 lookups) Amazon SES Postmark

Support & CRM Zendesk (support tickets) Freshdesk (uses 7 lookups) Help Scout Salesforce

Other senders (IP addresses or includes your provider gave you)

IP addresses or ranges

Other includes

Strict: reject everything else (-all) instead of soft fail (~all) Keep other entries from my current record

How to add it (3 steps)

Find where your DNS is managed: usually your domain registrar or web host (Afrihost, Xneelo, Domains.co.za, GoDaddy, Cloudflare) or Microsoft 365 if you bought the domain there. The NS records in a WHOIS lookup tell you which company it is.
Add (or edit) one TXT record: name @ (some panels want it empty or your full domain), value = the record above. If a record starting with v=spf1 already exists, edit it instead of adding a second one.
Check it: wait a few minutes, then run the SPF & DMARC checker. It should say SPF is good and count the lookups.

Why one record for everything?

Every service you use (your mailbox, newsletter tool, online shop, support desk) sends email “from” your domain. Gmail and Outlook check your SPF record to see if that service is allowed. Each service’s help page tells you to “add our SPF record”, but you may only have one; a second one breaks both. So all the services have to be combined into a single line, in the right format, under the limit of 10 DNS lookups. That’s what this tool does.

What the parts mean

v=spf1: “this is an SPF record”.
include:spf.protection.outlook.com: “also allow everyone Microsoft 365 allows”. Each include costs at least one lookup.
ip4:196.25.1.10: allow one server or range. Free: costs no lookups.
a / mx: allow your website server / your mail server. One lookup each.
~all or -all: what to do with everything else (mark suspicious / fail).

Over the 10-lookup limit?

Untick services you no longer use first (old newsletter tools are the usual culprit). Then move bulk email to a subdomain such as news.yourdomain.com, which gets its own SPF record and its own 10 lookups. Full walkthrough: fixing “SPF too many DNS lookups”.

Honest limits

The includes are the ones each service publishes (checked on 26 Oct 2026, and the lookup count is recounted live every time). Some services use account-specific records (HubSpot, Xero, many web hosts), so if yours isn’t listed, copy the include from its help page into “Other includes”. SPF alone doesn’t stop someone faking your visible From address: that needs DMARC plus DKIM.

Frequently asked questions

What is an SPF record?

SPF (Sender Policy Framework) is one TXT record on your domain that lists which services are allowed to send email as you, such as Microsoft 365, Google Workspace or your newsletter tool. Email servers check it to decide whether a message claiming to be from your domain is genuine.

Can I have two SPF records?

No. A domain may have only one SPF record. Two records make SPF fail completely. If two services each told you to add one, combine them into a single record, which is exactly what this generator does.

Should I use ~all or -all?

~all (soft fail) marks unlisted senders as suspicious; -all (hard fail) says they must be rejected. Start with ~all while you make sure every real sender is listed, and rely on DMARC for enforcement. Switch to -all later if you want to be strict.

What does “too many DNS lookups” mean?

Each include:, a and mx entry makes the receiving server do a DNS lookup, and includes can contain more includes. SPF allows a maximum of 10. Go over and SPF fails with a “permerror”, which can send your email to spam. The generator counts them live for you.

Where do I add the SPF record?

At the company that hosts your domain’s DNS (often your domain registrar or web host, or Microsoft 365 / Cloudflare). Add a TXT record with the name @ (or leave the name empty) and paste the value. Delete any older record that also starts with v=spf1.

How long until a new SPF record works?

Usually minutes, sometimes up to the old record’s cache time (often 1 hour). Use the DNS propagation checker to see when it has updated, then run the SPF checker to confirm it’s valid.

Related tools and guides

API: GET /api/spf-record?services=microsoft365,mailchimp&domain=example.com · MCP tool generate_spf_record.