SPF record generator
One SPF record.
Ten lookups at most.
An SPF record generator turns the list of services that send email for your domain into the one TXT record you publish. Tick your senders, paste any record you already have, and copy the result. It counts the DNS lookups against the limit of 10 as you go, because past 10 receivers fail SPF for every message.
It runs in your browser and nothing you type is sent to us. SPF is one of three records Gmail and Yahoo look for: how SPF, DKIM and DMARC fit together.
By the Builderify team
Use the include your provider documents. Pasted records are merged into one.
Publish it as the only TXT record starting v=spf1 on yourbrand.com, replacing any you have now. How to publish it.
What an SPF record
is made of.
An SPF record is a single line of text, starting v=spf1, that lists who may send mail for a domain. A receiver reads the terms from left to right and stops at the first one that matches the sending server.
| Term | What it does | Counts as a lookup? |
|---|---|---|
| v=spf1 | Marks the TXT record as an SPF record. It must come first. | No |
| include:domain | Allows whatever the other domain's own SPF record allows. This is how you add Google Workspace, Microsoft 365 or a newsletter service. | Yes, plus every include nested inside it |
| ip4: / ip6: | Allows an address or a range you name, such as your own mail server. | No |
| a / mx | Allow the addresses behind your domain's A record, or behind its mail servers. The standard caps an mx mechanism at 10 address lookups of its own. | Yes, one each |
| exists:domain | Matches when the domain you give has an A record. It is usually used with macros, as in Salesforce's include. | Yes |
| ptr | Looks up the sender's reverse DNS. RFC 7208 says this mechanism should not be published. | Yes |
| redirect=domain | Hands the whole check to another domain's record. Ignored if the record has an all mechanism. | Yes |
| all | Matches everything, so it goes last and says what to do with senders you did not list. | No |
From RFC 7208, sections 4.6.4, 5 and 6. Anything written after all is never tested.
Which ending: ~all or -all?
Either works. Google’s help page says it recommends ~all; Microsoft’s examples end in -all. Start with ~all while you are still finding every service that sends as you, and move to -all once the list is complete. Which one you choose matters less than having one record that lists every real sender.
- ~all
- Soft fail. Mail from senders you did not list is accepted but marked as suspicious. Google recommends this one.
- -all
- Hard fail. Mail from senders you did not list should be rejected. Microsoft's examples use this one.
- ?all
- Neutral. Says nothing about unlisted senders. It protects nothing, but it is valid.
- +all
- Pass. Allows the whole internet to send as your domain. Never publish it.
SPF has a limit of
10 DNS lookups.
RFC 7208 tells receivers to count every include, a, mx, ptr and exists term and every redirect while evaluating a record, and to return a permanent error when the total passes 10. A permanent error means SPF fails for every message from the domain, not only the one that tipped it over.
Includes inside includes count
An include costs one lookup, plus every include and mechanism inside the record it points to. GoDaddy is the most expensive on this page at 3 lookups for one line.
Addresses are free
ip4, ip6 and all never count. A record made only of address ranges can never run out of lookups, which is also why it can go out of date.
Empty answers count too
The RFC also says receivers should give up after two lookups that return nothing, such as an include of a domain with no SPF record. A typo in an include can break a record the same way.
What to do when a record goes over 10
Work down this list in order; each step costs less than the next.
-
01
Remove what you no longer use.
Old newsletter tools, a CRM you left, a helpdesk you replaced. Each stays in the record until somebody deletes it.
-
02
Check whether the service needs an include at all.
A service that sends with its own bounce domain passes SPF for itself, not for you. Amazon SES says SPF is set up implicitly for its default MAIL FROM domain, and Mailchimp's domain-authentication page mentions no SPF record. Follow what your provider's own page tells you.
-
03
Send from a subdomain.
Put the heavy sender on its own subdomain, such as
news.yourbrand.com, with a separate record. Google’s help page says each subdomain needs its own SPF record, so the two budgets of 10 stay apart. -
04
Replace an include with its addresses, only as the last resort.
Copying a provider’s ranges into
ip4andip6terms costs no lookups, but an include follows the provider’s changes and your copy does not. If you do it, put a date in your calendar to check it.
The SPF include for
each service, and its cost.
The include values below are the ones the generator uses, each from the page named beside it. The lookup counts are what each include resolved to in DNS on 3 November 2026, nested includes counted.
| Service | Include | Lookups | Worth knowing | Value from |
|---|---|---|---|---|
| Google Workspace | include:_spf.google.com | 1 | Gmail on your own domain | Google Workspace Admin Help |
| Microsoft 365 | include:spf.protection.outlook.com | 1 | Outlook and Exchange Online | Microsoft Learn |
| Zoho Mail | include:zohomail.com | 2 | Zoho's documented value; Zoho suggests one.zoho.com for several Zoho services (3 lookups) | Zoho Mail Help |
| Shopify | include:shops.shopify.com | 1 | On Google's list of common senders | Google Workspace Admin Help |
| Zendesk | include:mail.zendesk.com | 1 | On Google's list of common senders | Google Workspace Admin Help |
| Salesforce | include:_spf.salesforce.com | 2 | On Google's list of common senders | Google Workspace Admin Help |
| GoDaddy | include:secureserver.net | 3 | On Google's list of common senders | Google Workspace Admin Help |
| Mailchimp | include:servers.mcsv.net | 1 | On Google's list, but Mailchimp's own setup page mentions no SPF record | Google Workspace Admin Help |
| Amazon SES | include:amazonses.com | 1 | Only needed with a custom MAIL FROM domain; SES sets SPF up itself otherwise | Amazon SES |
| Builderify | include:spf.builderify.net | 1 | Broadcast and Sequences; the Domains page shows your exact record | Builderify Broadcast |
Your provider’s own page is the final word, and it can change: check it before you publish. A service that is not here still works in the generator. Type its include into the box and it is counted as one lookup, with a note that includes nested inside it add more.
Broadcast and Sequences send from your own domain, and the Domains page lists the exact records and checks them for you. Builderify’s setup also asks for an MX record, so on a domain whose mailboxes live at Google or Microsoft, send from a subdomain. Sending is 0.5 credit per email, and the 250 free credits every month cover 500 emails. See pricing.
No. Google’s sender guidelines require SPF or DKIM from everyone who sends to Gmail accounts, and SPF and DKIM plus a DMARC record from anyone sending more than 5,000 messages a day. The SPF, DKIM and DMARC guide builds the other two records, and this one shows which rules apply at your volume.
How to add an SPF
record to your DNS.
Publish the generated record as a TXT record on your domain, in the DNS of whoever hosts it: usually your registrar, or a service such as Cloudflare. Every host words its form differently, but the three fields are always the same.
Sign in where the domain’s DNS is managed and find the page that lists TXT records. Not sure who that is? Google’s help page says it is typically where you bought the domain.
Type TXT. Host @ for the domain itself, or the full domain name if your host asks for it. Value: the record the generator gives you. Some hosts want the value in quotes; Google’s page says to check your host’s help for that.
If a TXT record starting v=spf1 already exists, edit that one or remove it. With two, the RFC says receivers return a permanent error and SPF fails.
Run nslookup -type=TXT yourbrand.com in a Windows or macOS terminal, or dig +short TXT yourbrand.com on macOS and Linux, and look for a single line starting v=spf1. DNS answers are cached, so a change can take as long as the old record’s TTL to reach every receiver.
Google’s help page says to publish an SPF record for each subdomain that sends mail, and to complete the steps for each domain you set up.
Why an SPF record
fails.
Two SPF records on one domain
RFC 7208 section 4.5: if the lookup returns more than one record starting v=spf1, the result is a permanent error. Adding a sender means editing the record you have, not adding a second one.
More than 10 lookups
The same section 4.6.4 limit as above. Common causes are an old service nobody removed, or a provider whose include nests others: GoDaddy's alone costs 3.
Ending the record in +all
The qualifier defaults to +, so a bare all, or +all, authorises every server on the internet. The generator replaces a pasted +all with the ending you chose.
Listing senders after all
Mechanisms after all are never tested, so a service added at the end of the record is silently not allowed. The generator puts all last every time.
Leaving out a sender
Mail from a service you forgot fails SPF: a booking tool, an invoicing app, a store. Check the headers of a real message from each one, or read the DMARC reports in the setup guide.
Expecting SPF to fix spam placement
SPF says who may send, not whether people want the mail. If authenticated mail still lands in spam, why business emails go to spam reads the headers and ranks the causes.
SPF records, before you ask.
If Google Workspace is the only service sending email for your domain, publish one TXT record on the domain with the value v=spf1 include:_spf.google.com ~all. That is the record Google's own help page gives. If other services send as you as well, tick them in the generator and it merges them into the same record, because a domain may publish only one.
No. RFC 7208 says that if a lookup returns more than one record starting v=spf1, receivers return a permanent error, and SPF then fails for every message from the domain. Add new senders by editing the record you have. Pasting your existing records into the generator merges them into one.
RFC 7208 tells receivers to count the include, a, mx, ptr and exists terms and the redirect modifier while evaluating a record, and to return a permanent error when the total passes 10. Includes nested inside other includes count as well. The terms ip4, ip6 and all cost nothing. The generator shows the count as you add senders.
Either is valid. Google's help page recommends ~all, which accepts mail from unlisted senders but marks it as suspicious, and Microsoft's examples end in -all, which asks receivers to reject it. Many people start with ~all while they find every sender and switch to -all once the list is complete. Never end a record in +all, which allows everyone.
Usually yes. Google's sender guidelines require SPF or DKIM from everyone who sends to Gmail accounts, and SPF and DKIM plus a DMARC record from anyone sending more than 5,000 messages a day to Gmail. Publishing all three covers every case.
No. It runs in your browser, so the domain and records you type stay on your device. It does not look anything up in DNS, which is why the lookup counts for the listed services were measured in advance and are dated on the page.
Sources
Every page above was opened on 3 November 2026. Lookup counts were measured in DNS the same day. ← All free tools
More on email deliverability
All deliverability guides- How to Set Up SPF, DKIM and DMARC, Step by Step Set up SPF, DKIM and DMARC for your newsletter domain: merge SPF records, stay under 10 lookups and build a DMARC record that meets Gmail and Yahoo rules.
- Gmail & Yahoo Bulk Sender Requirements: Do They Apply? Do the Gmail and Yahoo bulk sender requirements apply to you? Enter your busiest day to see which rules you are under and what to set up, free.
- Why Are My Business Emails Going to Spam? Find the Cause Business emails going to spam? Read the SPF, DKIM and DMARC lines in one message, then pick your symptoms to see the likely causes and fixes, free.
- WordPress Contact Form Not Sending Email? Find the Cause WordPress contact form not sending email? Check the To address, put your own domain in From, add SPF and DKIM, then send via SMTP. Free diagnoser inside.
Stop losing the visitors
you already paid for.
More leads from the traffic you already have, and follow-up that sends itself. Free to start. No card, no monthly fee.