Build a Valid SPF Record in 30 Seconds

Generate your record

Pick every service that sends mail for this domain — your mailbox provider, marketing platform, transactional sender, anything else. The generator merges them into one record and counts DNS lookups against the 10-lookup limit as you go.

Record ready? Have a specialist double-check it — the $49 Email Domain Trust Audit is a fixed-output report with risk notes and prioritized next steps.

After you publish

1. Publish it as a TXT record at your domain root (or the subdomain you send from). Keep exactly one v=spf1 record per domain.
2. Wait for propagation — usually minutes, occasionally a few hours.
3. Verify the domain end to end — SPF is one leg of the stool. Run the free domain trust check to confirm SPF, DMARC, DKIM, and MX all agree:

• Run the Free Email Domain Trust Checker
• SPF flattening and the 10-lookup limit, explained

4. Verify the record itself — once DNS propagates, run the Free SPF Record Checker to confirm the v=spf1 record parses cleanly and stays under the 10-DNS-lookup limit.

Complete the authentication set

Email authentication needs all three records working together. Generate the rest of the set, free, in your browser:

• Free DKIM Record Generator

• Free DMARC Record Generator

• Free BIMI Record Generator

• Free MTA-STS Record Generator

Prefer done-for-you?

If you'd rather hand this to a specialist, submit your domain for the Email Domain Trust Audit — a fixed-output report with risk notes and prioritized next steps. When records are broken and you want them fixed, the 99 Mailbox Rescue gets them fixed within 48 hours, zero tech touch.

Frequently asked questions

What does an SPF record do? An SPF (Sender Policy Framework) record is a DNS TXT record that lists which servers are allowed to send mail for your domain. Receiving mail servers check it to decide whether a message is really from you — a missing or broken SPF record is one of the most common reasons legitimate mail lands in spam.

What is the SPF 10 DNS lookup limit? SPF evaluation may perform at most 10 DNS lookups (RFC 7208). Each include, a, mx, ptr, exists mechanism and each redirect counts as one. Exceeding the limit makes the whole record fail with a permerror. The generator above counts your lookups live so you stay under the cap.

Should I end my SPF record with ~all or -all? Start with ~all (softfail): mail from unlisted servers is flagged but still delivered, so you can test safely. Move to -all (hard fail) once you have confirmed every legitimate sender is listed — a strict -all with a missing sender silently drops real mail.

Where do I publish the generated record? Publish it as a TXT record at your domain root (the '@' or bare-domain record in your DNS provider's dashboard). If you send from a subdomain, publish a separate record on that subdomain. DNS changes can take minutes to hours to propagate.

Can I have more than one SPF record on a domain? No — a domain must publish exactly one SPF record. Multiple v=spf1 TXT records cause a permerror. Merge every sender into a single record; the generator builds one record for you.

:::cta title: Published it? Verify the whole domain. body: SPF is one leg of the stool. Run the free domain trust check to confirm SPF, DMARC, DKIM, and MX all agree before your next send. links: - href: tools/email-domain-trust-checker label: Check My Domain Free event: click_free_tool location: closing_free_checker - href: spf-flattening-lookup-limit label: SPF Lookup Limit Guide event: click_related location: closing_spf_guide :::