A free SPF record generator that builds a valid v=spf1 TXT record for your domain. Add your IPs and providers, pick an SPF policy, copy the SPF record. SPF record generator no signup, no rate limit for normal SPF use.
Add IPv4 or IPv6 addresses authorized to send mail for this domain.
Add third-party sending services like Google Workspace or SendGrid.
An SPF record is a single TXT record listing every source allowed to send mail with your domain in the envelope sender. This free SPF record generator turns that list into the exact syntax receivers expect, so you are not hand-writing a grammar you use twice a year.
Receiving servers read the SPF record at delivery time, compare the connecting IP against it, and apply the qualifier you chose. The SPF record generator emits the mechanisms in conventional order and keeps the record inside the ten DNS lookup limit.
Every SPF mechanism the generator can emit, and what each one authorises inside your SPF record.
The final SPF mechanism decides what happens to everything the SPF record does not list. SPF record generator no signup means you can rebuild the SPF record as often as you like while you tune it.
| Qualifier | Behavior |
|---|---|
| +all | All senders pass. Never use this — it defeats SPF entirely. |
| ~all | Softfail — unauthorized mail is accepted but flagged. Use while testing. |
| -all | Hard fail — unauthorized mail is rejected. Use in production. |
| ?all | Neutral — no policy stated. Rarely useful. |
Paste these SPF includes into the generator if you send through any of them; each one adds its own SPF lookups.
Every include:, a, mx, ptr, and exists: mechanism costs one DNS lookup while SPF is evaluated, and RFC 7208 caps the total at ten. Exceed it and receivers return a permerror, which many treat as having no SPF at all. Our SPF record generator keeps the SPF output flat and warns you before the SPF record grows past that ceiling.
SPF alone protects the envelope sender (Return-Path), not the visible From address. For complete spoofing protection, you also need DKIM to sign your messages and DMARC to align authentication results with the From header. Together, these three standards form the email authentication baseline expected by Gmail, Outlook, and Yahoo Mail.
After setting up SPF, make sure your lists are clean too. Email verification removes invalid and risky addresses before you send, which keeps bounce rates low and protects the sender reputation you build with proper authentication. You can also verify addresses in bulk via bulk email verification or integrate verification directly into your stack via the email validation API.
What the record says
An SPF record is one TXT string that lists every source allowed to send mail using your domain in the envelope. A free SPF record generator turns that policy decision into correct syntax without you memorising the grammar.
SPF does not block anything by itself. The record you publish tells receiving servers which IPs and providers are authorised, and each receiver decides what to do when a message arrives from somewhere else.
That is why SPF record generator asks two things: where your mail legitimately comes from, and how strictly you want unauthorised sources treated.
ip4 and ip6 authorise specific addresses or CIDR ranges you control. include: delegates to a provider's own SPF record, so Google, Microsoft, Mailchimp, SendGrid, and Mailgun stay correct when they change infrastructure.
a and mx authorise whatever your domain's own A or MX records point at. The SPF record generator emits them in the conventional order so evaluation stops early on the common case.
-all is a hard fail: anything not listed is unauthorised. ~all is a soft fail, usually treated as suspicious rather than rejected. ?all is neutral and enforces nothing.
A free SPF record generator that defaults straight to -all is doing you no favours. Publish ~all first, watch what breaks, then tighten. The generator offers all three deliberately.
Every include:, a, mx, ptr, and exists: mechanism costs a DNS lookup, and the SPF specification caps evaluation at ten. Exceed it and receivers return permerror — which many treat as no SPF at all.
This is the most common way a hand-written record silently stops working. The SPF record generator keeps the output flat and warns you before the record gets long enough to matter.
Reading your record
The output is short enough to read end to end. Knowing what each token does is what lets you edit it later without breaking delivery.
Every SPF record starts with it, and a TXT record without it is not an SPF record at all. Only one SPF record may exist per domain; two published records are a permerror, not a merge.
If the SPF record generator output replaces an existing record, merge the mechanisms by hand rather than publishing both.
include:_spf.google.com pulls in whatever Google currently authorises. You inherit their changes automatically, and you also inherit their DNS lookup cost against your ten-lookup budget.
Only include providers that actually send as your domain. Every unused include is lookup budget spent for nothing.
Use these for mail servers you run. They cost no DNS lookups, which makes them the cheapest way to stay under the limit when you have many sources.
CIDR notation is supported, so a whole range is one mechanism rather than a list of them.
The final mechanism is the one receivers act on most. Start at ~all while you confirm every legitimate source is listed, then move to -all once a week of reports comes back clean.
Going straight to -all on a domain with forgotten senders is the fastest way to lose real mail.
Publishing it
Four steps, and the third one is where most people stop too early.
Marketing platform, transactional provider, CRM, helpdesk, invoicing system, the office mail server nobody has touched in years. Anything that sends as your domain belongs in the record.
Run the free SPF record generator once you have the full list, not before. A record generated from half the list will break the other half.
Host is @ or the bare domain, type TXT, value is the generated string. Propagation is usually minutes, occasionally an hour.
Do not publish it as a SPF-type record — that record type was deprecated years ago and receivers ignore it.
DNS providers wrap, split, and truncate long TXT values in surprising ways. Check the published record after propagation with SPF Checker, because what free SPF record generator produced and what your DNS actually serves are not always the same string.
A record that looks right in the DNS panel and resolves wrong is a common failure, and it is invisible until you query it.
After a week with no legitimate failures, change ~all to -all and republish. That is the point at which SPF starts actually protecting the domain.
Re-run SPF record generator whenever a sending provider is added or removed, rather than editing the live string in the DNS panel.
Limits
SPF is one of three sender-authentication records. Expecting it to do the other two jobs is where most misconfiguration starts.
When a message is forwarded, the envelope sender stays yours while the delivering IP becomes the forwarder's. SPF fails, correctly, on mail that is entirely legitimate.
This is exactly why DKIM exists, and why DMARC accepts either one passing in alignment.
SPF authorises the envelope sender, which recipients never see. A message can pass SPF while displaying any From address it likes.
Only DMARC ties the visible domain to an authenticated one. SPF alone stops nothing a user would notice.
Publishing a perfect record says nothing about whether the addresses you send to exist. Sender authentication and recipient verification are separate problems.
For the recipient side, use Email Verifier or bulk verification before a campaign, and treat the two as separate parts of the same sending workflow.
A correct SPF record is a precondition for good delivery, not a cause of it. Content, complaint rates, and bounce rates still decide inbox placement.
Get the record right first, then work on the rest.
References and next steps
SPF is defined by the IETF, and the tools around this SPF record generator cover the checks it does not.
The IETF's RFC 7208 defines SPF, its mechanisms, its qualifiers, and the ten-lookup evaluation limit this SPF record generator keeps you under.
Reading it is not required to publish a record, but it settles every argument about what a qualifier means.
After publishing, the SPF Checker resolves the live record and reports lookup count, syntax errors, and the effective policy.
Generate here, verify there — that pairing catches the DNS-panel mangling a generator cannot see.
SPF is one third of the picture. The DMARC Generator and DKIM tools cover alignment and message signing.
A domain with SPF but no DMARC is authenticated and still spoofable in the From line.
Nineteen free tools alongside the paid AI features, none of them requiring an account.
Free Tools
Free SPF record checker: resolve the live SPF record for any domain, count DNS lookups, and validate the syntax. SPF record checker and validator, no signup.
Domain or infrastructure evidence — not mailbox proof.
Free Tools
Free DKIM record generator: build the v=DKIM1 TXT record and the selector._domainkey hostname for any provider. A free DKIM DNS record generator, no signup.
Free Tools
Free DMARC record generator: build a valid v=DMARC1 TXT record with policy, alignment, and reporting tags in seconds. Free DMARC policy record generator, no signup.
Free Tools
Free DNS record lookup for any domain: A, AAAA, MX, TXT, NS, CNAME, SOA resolved live from authoritative nameservers. DNS record lookup tool, free, no signup.
Email Tools
Free email deliverability test: send one message and get authentication, DNS, spam-filter, blacklist, header, and content scores. A free email inbox placement test, no signup.
Sender or message diagnostics — not address discovery.
Email Verify Tools
Check if an email address is valid with a free email verifier, no signup — syntax, MX, SMTP mailbox, disposable, role and catch-all checks.
Recipient evidence — not sender or DNS configuration.
Yes — SPF record generator no signup, no account, no limit on how many SPF records you build. The SPF logic runs entirely on the page, and nothing about your domain or your SPF setup is stored.
Publish it as a TXT record at your domain root: host @ or the bare domain, type TXT, value the generated string. Do not use the deprecated SPF record type — receivers ignore it. Propagation usually takes minutes.
No. One SPF record per domain. Two published records are a permerror, and receivers do not merge them. If you already have a record, merge its mechanisms into the SPF record generator input rather than publishing a second one.
Start with ~all. It marks unauthorised mail as suspicious without rejecting it, which gives you a week to find the sending source nobody remembered. Move to -all once nothing legitimate is failing. A free SPF record generator that jumps straight to -all costs you real mail.
Two things. Adding provider includes until you cross ten DNS lookups, and DNS panels splitting or truncating a long TXT value. Re-run free SPF record generator when providers change, and verify the live record with the SPF Checker afterwards.
Not on its own. SPF authorises the envelope sender, which nobody sees. Only DMARC ties the visible From domain to an authenticated one, so treat SPF as step one of three: SPF, DKIM, DMARC.
SPF record generator no signup — build the SPF record, publish it, then verify the live SPF record and check the addresses you actually send to.
SPF record generator no signup · 99.9% SMTP accuracy · Instant API access · No credit card required
