New tools added: CVE Lookup, MAC Lookup, Bandwidth Calculator, RAID Calculator and DMARC Parser — all free, no account needed. Now featuring SPMT for SharePoint readiness and mapping at spmt.toolforge.co.uk.

SPF Record Generator

Build a valid SPF TXT DNS record for your domain using a guided form. Copy the result directly into your DNS.

Authorised sources

Generated SPF record
v=spf1 mx -all
How to add: Create a TXT record on your domain with the value above.

About SPF Records

SPF (Sender Policy Framework) is a DNS TXT record that specifies which mail servers are authorised to send email from your domain. When a receiving server gets an email claiming to be from @example.com, it looks up the SPF record for example.com and checks whether the sending server's IP is listed. This helps prevent spammers from forging your domain as the sender.

SPF mechanisms

  • ip4:x.x.x.x / ip6:... — Authorises a specific IP address or CIDR range
  • mx — Authorises the mail servers listed in the domain's MX records
  • a — Authorises the IP addresses in the domain's A/AAAA records
  • include:domain — Imports the SPF record of another domain (used by third-party senders like Google Workspace, Mailchimp, SendGrid)

The all mechanism (the most important part)

  • -all — Hard fail: reject mail from any server not listed (recommended for strict domains)
  • ~all — Soft fail: accept but mark as suspicious (good for initial deployment)
  • ?all — Neutral: no policy (provides minimal protection)
  • +all — Pass all: allows anyone to send — never use this

The 10-lookup limit

SPF evaluation is limited to 10 DNS lookups. Each include:, mx, and a mechanism counts as one lookup. Third-party email providers (SendGrid, Mailchimp, HubSpot, Salesforce) each consume one lookup. Exceeding 10 lookups causes a permerror that may result in SPF failure. This tool counts your lookups and warns if you approach the limit.

Related tools

All Email & Deliverability →
Email Header Analyzer Paste raw email headers and get a full breakdown of routing, authentication and … DMARC Record Generator Generate a properly formatted DMARC policy record for your domain. DKIM Helper Understand DKIM setup, generate DKIM key pairs and get guidance for your DNS rec… MX Health Summary Run a full email health check — MX, SPF, DMARC, DKIM and blacklist status in one…

Frequently asked questions

Where do I add the SPF record?
Add the SPF record as a TXT record on your domain's root (@) in your DNS provider's control panel. You should only have one SPF record per domain — merge multiple senders into a single record using include: mechanisms.
What is the -all vs ~all policy?
-all (hardfail) rejects mail from unauthorised senders. ~all (softfail) marks it as suspicious. -all is the most secure. Use ~all while transitioning to avoid accidentally rejecting legitimate email.