Free SPF Record Generator

Create a valid SPF record for your domain to prevent email spoofing.

Your SPF Record

v=spf1 ~all
Length: 12 chars
DNS Lookups: 0 / 10

Start from your current record

Enter your domain and we'll fetch its live SPF record, load it into the generator, and flag problems like duplicate records.

How to Add This Record

1. Log in to your DNS provider
2. Navigate to DNS records
3. Add a new TXT record
4. Set Host to @
5. Paste the SPF record as Value
6. Save and wait for propagation

Email Service Providers

Select the services that send email on behalf of your domain.

Sending from your own server with self-hosted software like Broadcast? Add your server's IP address under Advanced Options below.

Failure Policy

What should happen when an email fails SPF validation?

Advanced Options

Domain Mechanisms

Custom Includes

Add additional domains (one per line)

IPv4 Addresses

CIDR notation supported

IPv6 Addresses

CIDR notation supported

Understanding SPF Records

What is SPF?

SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send email for your domain. When your message arrives, the receiving server checks whether the sending server is on that list. If it is, your mail looks legitimate. If it isn't, your mail gets flagged or rejected, depending on your policy.

Without SPF, anyone can put your domain in the From address and most receivers have no way to tell the difference. Gmail, Yahoo, and Microsoft now expect SPF on every sending domain, so a missing record hurts deliverability even if nobody is spoofing you.

How a check works

The receiving server takes the domain from the envelope sender (the return-path, not the visible From address), fetches its TXT records, and evaluates each mechanism left to right. The first match wins. If nothing matches, the all mechanism at the end decides the result: soft fail, hard fail, or neutral.

Because SPF checks the envelope sender, it can't stop a forged From header by itself. That is DMARC's job, and it's why the two belong together.

Limits to respect

10 DNS lookups max

Every include, a, mx, exists, and redirect costs one lookup, and includes nest. Go over and receivers return a permanent error.

One record per domain

Two SPF records is an automatic failure. Merge everything into one.

255 characters per string

Longer records must be split into multiple quoted strings inside one TXT record. Most DNS providers do this for you.

~all or -all?

~all (soft fail) tells receivers to accept but distrust unlisted servers. -all (hard fail) tells them to reject outright. Start with soft fail while you confirm every legitimate sender is in your record, then move to hard fail. And never use +all: it authorizes the entire internet to send as you.

Example SPF records

Google Workspace only:

v=spf1 include:_spf.google.com ~all

Google Workspace for regular mail plus Amazon SES for campaigns:

v=spf1 include:_spf.google.com include:amazonses.com ~all

A self-hosted mail server at a fixed IP address, with hard fail:

v=spf1 ip4:203.0.113.25 -all

What does v=spf1 mean?

Every SPF record starts with v=spf1, which marks the TXT record as an SPF record, version 1. There is no version 2. A record that does not start with v=spf1 is ignored by receiving servers.

Does SPF stop email spoofing on its own?

No. SPF validates the envelope sender, an address recipients never see, so a forged From header can still pass. To actually stop spoofing, pair SPF with DKIM signatures and a DMARC policy that ties the two back to the visible From address.

Does SPF break when emails are forwarded?

Often, yes. When someone forwards your email, it arrives from the forwarder's server, which is not in your SPF record, so the check fails. This is a known weakness of SPF, not a mistake in your record. DKIM signatures survive forwarding, which is one more reason to set up both.

Do subdomains need their own SPF records?

Yes, if you send mail from them. Receivers check the exact domain in the envelope sender, so mail from news.example.com needs an SPF record on news.example.com. A record on the root domain does not cover its subdomains.

What is SPF flattening?

Flattening replaces include mechanisms with the IP addresses they resolve to, cutting DNS lookups to zero so large setups fit under the 10 lookup limit. The trade-off: providers change their IPs without notice, so a flattened record goes stale unless something keeps it updated. Only flatten when you are actually hitting the limit.

How long until my SPF record takes effect?

As soon as your DNS change propagates, which is governed by your TTL setting. For most domains that means minutes to an hour. You can verify the record is live by querying your domain's TXT records or running a DMARC test.

How do I test my SPF record?

Use the lookup at the top of this page to fetch and check the record you published, or run your domain through our DMARC testing tool to validate SPF, DKIM, and DMARC together. You can also send a test email to a Gmail address and use Show Original to see the SPF verdict.

Not sure your setup is right? Run your domain through our DMARC testing tool to check SPF, DKIM, and DMARC in one pass.

Own your email platform

Broadcast is self-hosted email marketing software. Pay once, own it forever, and take full control of your email infrastructure.

Learn More
More free tools: DMARC Testing Tool DMARC Record Generator Email Spam Checker Subject Line Analyzer Preview Text Generator All tools →