Bug Circuit

Free tool · no signup

SPF record generator

Tick the services that send email for your domain and get the exact SPF record to publish in DNS. It checks the 10-lookup limit that breaks many records.

By the Bug Circuit security team · Last updated

Who sends email as your domain?

Email services you use
TXT record value
v=spf1 ~all
Type
TXT
Name / host
@ (your domain)
DNS lookups
0 of 10
  • No senders listed. This record tells the world that your domain sends no mail at all, which is right only for a domain that never sends email.
What is an SPF record? A DNS TXT record that lists who is allowed to send email as your domain. Choose your email services below, copy the record and add it as one TXT record on your domain. Publish only one SPF record per domain, and stay under 10 DNS lookups.

How it works

What SPF does

SPF (Sender Policy Framework, RFC 7208) lets a domain publish the list of servers that may send mail for it. When a message arrives claiming to be from you, the receiving server looks up your SPF record and checks whether the sending server is on the list. If not, it can mark the message as suspicious or reject it.

The record starts with v=spf1, then lists mechanisms such as include:_spf.google.com (trust Google's servers), ip4:203.0.113.5 (trust one address), mx (trust the servers in your MX records) and ends with an instruction for everyone else: ~all (soft fail), -all (reject) or ?all (neutral).

The two rules that break most records

One record only. A domain must have a single SPF TXT record. If you add a second one, for example when you start using a new email service, receivers see two records and treat SPF as broken (a PermError). Merge the new include into your existing record instead.

Ten lookups at most. Every include, a, mx, ptr, exists and redirect makes the receiver do a DNS lookup, and the services you include have includes of their own. Past 10 in total, SPF fails. This generator counts the lookups you add and warns as you approach the limit, but it cannot see inside every provider's record, so test the published result.

SPF is one of three checks

SPF alone does not stop someone from faking the visible From address. DKIM signs your messages, and DMARC tells receivers what to do when SPF and DKIM do not line up with the From domain. Set up all three. After publishing, run the email spoofing checker to confirm they work together.

Worked examples

Google Workspace only

One service: Google Workspace. Soft fail for everyone else.

v=spf1 include:_spf.google.com ~all

The most common record for a small business. Move to -all after a few weeks of clean DMARC reports.

Google plus a newsletter service and your own server

Google Workspace, SendGrid and a server at 203.0.113.5.

v=spf1 ip4:203.0.113.5 include:_spf.google.com include:sendgrid.net ~all

Three senders, three lookups at most from your own record. Each provider adds some of its own.

A domain that never sends mail

Parked or brand-protection domains.

v=spf1 -all

Tells the world nothing is allowed to send as this domain, which stops it being used in phishing.

Frequently asked questions

Can I have two SPF records on one domain?
No. Two SPF TXT records on the same name make SPF fail. Combine all your senders into one record.
What is the difference between ~all and -all?
~all (soft fail) tells receivers that other senders are probably not allowed and to treat the mail with suspicion. -all (hard fail) tells them to reject it. Start with ~all, and switch to -all once your DMARC reports show that all legitimate mail passes.
How many includes can I use?
The limit is 10 DNS lookups in total, counting includes inside the records you include. In practice that means about three or four email services. If you go over, remove services you no longer use or use a flattening service.
Do I need SPF if I already have DKIM and DMARC?
Yes. DMARC passes when either SPF or DKIM passes and lines up with your From domain, and many receivers still check SPF directly. Use all three.
Why does my record say PermError?
The usual causes are two SPF records on one domain, more than 10 lookups, or a typo in an include. Fix the record and test it with the email spoofing checker.
Does SPF apply to subdomains?
No. Each subdomain that sends mail needs its own SPF record, and a subdomain that sends no mail should publish v=spf1 -all.

Keep reading

Email Spoofing CheckerTest SPF, DKIM and DMARC for your domain.DMARC Record GeneratorThe policy that ties SPF and DKIM together.DNS Record LookupSee the records you published.Security checklist before launchEmail authentication is on it.

See what attackers see, for free

Run the free passive check on your website. No login, no impact on your site, results in seconds.

Ready for the full manual audit? See pricing

SPF Record Generator: Build a Valid SPF Record · Bug Circuit