--- title: "SPF Record Generator: Create a Valid SPF Record | Prosyo" description: "Free SPF record generator: pick Google Workspace, Microsoft 365 and other senders, get one valid SPF record and see the DNS lookup count before you publish." url: "https://prosyo.com/tools/spf-generator/" image: "https://prosyo.com/wp-content/uploads/2026/10/cropped-Prosyo-Icon-Transparent-1.png" language: "en" --- Free Tools # SPF Record Generator Pick the services that send email for you and get a valid SPF record, with the DNS lookup count checked live before you publish. SPF Record GeneratorInstant · results in seconds 100% free 1. 1Fill in 2. 2Run the check 3. 3Fix & use What you get - A plain-English verdict in seconds - Every record found, with what it means - The exact fix for anything that fails **Agent Penny***Your AI SDR* **Do this for every prospect, automatically** Penny finds your buyers, writes personal LinkedIn and email outreach, sends it from your own accounts and drafts every reply. [Start free, 7 days](https://app.prosyo.com/?utm_source=prosyo-tools&utm_medium=tool-side&utm_campaign=spf-generator) No card required · Cancel in two clicks **Run outbound on autopilot**Personal LinkedIn and email outreach, sent from your accounts, replies drafted for you.[Start free, 7 days](https://app.prosyo.com/?utm_source=prosyo-tools&utm_medium=article&utm_campaign=spf-generator)No card required ## What is an SPF record generator? An SPF record generator builds the Sender Policy Framework (SPF) record your domain needs so that mailbox providers know which servers are allowed to send email as you. SPF is a single TXT record in your DNS. It lists your email provider, the other services that send on your behalf (a CRM, a support desk, a marketing platform) and any servers you run yourself, then says what receivers should do with mail from anywhere else. Writing that record by hand is easy to get wrong. A missing space, a second SPF record, an include for a service that has changed its address, or one service too many can make SPF fail for every message you send. This free SPF record generator removes the guesswork: tick the services that send for you, add any IP addresses, choose a policy and you get one valid record. Before you publish, it resolves every include live and counts the DNS lookups against the limit of 10, checks whether your domain already has an SPF record, and tells you exactly what to do next. ## Key takeaways - A domain must have exactly one SPF record. Add new senders to it; never publish a second one. - SPF allows at most 10 DNS lookups. Every include counts, and so do the includes inside it. - End the record with ~all while DMARC does the enforcing; use -all only when you are sure every sender is listed. - SPF alone does not stop spoofing. Pair it with DKIM and a DMARC record. - Only list services that actually send email from your domain today. ## How to use the SPF record generator 1. **Enter your domain**, for example `yourcompany.com`. The tool uses it to check what you publish today. 2. **Tick every service that sends email as your domain.** Your mailbox provider (Google Workspace, Microsoft 365, Zoho) is the obvious one. Think about your CRM, help desk, invoicing tool and newsletter platform too. 3. **Add your own sending IPs** if you run a mail server or send from an application server. Ranges such as `198.51.100.0/24` work. 4. **Add other includes** that a service’s setup guide gave you, for example `include:_spf.example.net`. 5. **Choose what happens to mail from anywhere else.** Soft fail (`~all`) is the safe default. 6. **Press “Generate SPF record”**, copy the record and publish it as a TXT record on the root of your domain (host `@`). **Free tools fix one email. Prosyo fixes the pipeline.**Penny researches every buyer, writes personal LinkedIn and email outreach and books the meetings, from your own accounts. [Try Prosyo free](https://app.prosyo.com/?utm_source=prosyo-tools&utm_medium=article&utm_campaign=spf-generator) ## How an SPF record is built Every SPF record starts with `v=spf1` and ends with an `all` mechanism. In between are the mechanisms that describe your senders. The generator uses the common ones: | Mechanism | Example | What it allows | DNS lookups | | --- | --- | --- | --- | | `include:` | `include:_spf.google.com` | Every server the included domain’s SPF record allows | 1, plus any inside it | | `ip4:` | `ip4:203.0.113.10` | One IPv4 address or a range | 0 | | `ip6:` | `ip6:2001:db8::/32` | One IPv6 address or a range | 0 | | `a` | `a` | The IP addresses of the domain’s own A record | 1 | | `mx` | `mx` | The domain’s mail servers | 1, plus one per MX host | | `all` | `~all` | What to do with everything not listed | 0 | A typical record for a company on Google Workspace that also sends from a CRM looks like this: `v=spf1 include:_spf.google.com include:_spf.salesforce.com ~all`. ## SPF includes for popular email services These are the includes the generator uses. Always confirm against the service’s own setup page, because providers occasionally change them and some accounts use regional variants. | Service | Include | Notes | | --- | --- | --- | | Google Workspace | `include:_spf.google.com` | Covers Gmail sending for your domain. | | Microsoft 365 | `include:spf.protection.outlook.com` | Exchange Online and Outlook. | | Zoho Mail | `include:zoho.com` | Accounts in the EU or India use `zoho.eu` or `zoho.in`. | | Amazon SES | `include:amazonses.com` | Often belongs on a custom MAIL FROM subdomain instead. | | SendGrid | `include:sendgrid.net` | Not needed on the root once domain authentication is set up in SendGrid. | | Mailgun | `include:mailgun.org` | Usually published on the sending subdomain. | | Mailchimp transactional (Mandrill) | `include:servers.mcsv.net` | For Mandrill sending. | | Salesforce | `include:_spf.salesforce.com` | Email sent from Salesforce. | | Zendesk | `include:mail.zendesk.com` | Support replies sent as your domain. | | Freshdesk | `include:email.freshdesk.com` | Support replies sent as your domain. | | Proton Mail | `include:_spf.protonmail.ch` | Custom domains on Proton. | | Fastmail | `include:spf.messagingengine.com` | Custom domains on Fastmail. | ## The 10 DNS lookup limit, explained When a receiving server checks SPF, it may have to look up more DNS records to expand your includes. The SPF standard caps that at 10 lookups. Go over and the check returns a permanent error (`permerror`), which most receivers treat as an SPF failure for every message, even ones from legitimate servers. The trap is that includes contain includes. One line in your record can cost three or four lookups once the service’s own record is expanded. That is why this generator resolves every include live and adds up the real total. If you are at 8 or 9, you are one new tool away from breaking SPF. Ways to stay under the limit: - **Remove services you no longer use.** Old newsletter tools and trial CRMs are the usual suspects. - **Use IP addresses instead of includes** for servers you control; `ip4` and `ip6` cost nothing. - **Move bulk or marketing senders to a subdomain** such as `news.yourcompany.com`, with its own SPF record. - **Check whether a service needs the include at all.** Many sending platforms use their own return-path domain once you authenticate your domain with them, so SPF is checked against their domain, not yours. ## ~all or -all? The last term of the record tells receivers what to do with mail from servers you did not list. | Ending | Name | Effect | When to use it | | --- | --- | --- | --- | | `~all` | Soft fail | Unlisted mail is accepted but marked suspicious. | The default for most domains, with DMARC doing the enforcing. | | `-all` | Hard fail | Unlisted mail fails SPF outright. | When every sender is definitely listed, or for domains that never send. | | `?all` | Neutral | No statement at all. | Testing only. It gives no protection. | | `+all` | Pass | Anyone may send as you. | Never. The generator will not produce it. | For domains that do not send email at all, the best SPF record is simply `v=spf1 -all`, together with a DMARC record of `p=reject`. ## Publishing the record 1. Open the DNS settings wherever your domain’s DNS is hosted (your registrar, Cloudflare, your web host). 2. Look for an existing TXT record that starts with `v=spf1`. If there is one, edit it. Do not add a second. 3. Create or edit a **TXT** record with host `@` (or blank, depending on the provider) and paste the record as the value. 4. Save, wait for the change to propagate (usually minutes, sometimes up to the record’s TTL), then run the [SPF Checker](https://prosyo.com/tools/spf-checker/) to confirm it resolves and passes. ## Common SPF mistakes this tool prevents - **Two SPF records.** Publishing a new record next to an old one makes SPF fail. The generator checks your live DNS and warns you. - **Too many lookups.** Counted live, including nested includes. - **Includes that do not exist.** A typo or a retired include makes the whole record fail. Each include is resolved before you publish. - **Using `+all`.** Never offered. - **Invalid IP syntax.** Addresses and ranges are validated as you generate. - **The deprecated `ptr` mechanism.** Not offered; it is slow and discouraged by the standard. ## SPF, DKIM and DMARC work as a team SPF checks the server that sent a message against the envelope sender (the return-path), which the reader never sees. It says nothing about the visible From address, and it breaks when mail is forwarded. DKIM adds a cryptographic signature that survives forwarding. DMARC ties both to the From address the reader sees and tells receivers what to do when checks fail. Gmail, Yahoo and Microsoft all expect senders to have SPF and DKIM in place, and bulk senders must also publish DMARC. After publishing SPF, turn on DKIM signing in each service (check it with the [DKIM Checker](https://prosyo.com/tools/dkim-checker/)), then create a DMARC record with the [DMARC Generator](https://prosyo.com/tools/dmarc-generator/). The [Domain Health Checker](https://prosyo.com/tools/domain-health-checker/) scores all of it in one pass. ## SPF for cold email domains Teams that send cold email usually use separate secondary domains, each with a few inboxes on Google Workspace or Microsoft 365. Those domains need a simple SPF record listing only their mailbox provider, for example `v=spf1 include:_spf.google.com ~all`. Keep them clean: no marketing platforms, no support tools, nothing that does not send from that domain. Then warm the inboxes up with the [Warm-up Planner](https://prosyo.com/tools/email-warmup-planner/) before any cold volume. ## Worked example Northwind runs email on Microsoft 365, sends invoices from a billing tool that uses SendGrid, and has a contact form on its own server at `203.0.113.25`. The team ticks Microsoft 365 and SendGrid, adds the IP and keeps soft fail. The generator returns `v=spf1 include:spf.protection.outlook.com include:sendgrid.net ip4:203.0.113.25 ~all` and counts the lookups after expanding both includes, comfortably under 10. It also finds an old record, `v=spf1 include:_spf.google.com ~all`, left over from before the company moved to Microsoft. The team replaces that old record with the new one instead of adding a second, then confirms with the SPF Checker an hour later. ## Glossary - **SPF (Sender Policy Framework)**: a DNS record listing the servers allowed to send mail for a domain. - **Envelope sender / return-path**: the address SPF is checked against, used for bounces. - **Include**: a mechanism that adds another domain’s SPF record to yours. - **permerror**: a permanent SPF error, for example too many lookups or two records. - **Soft fail / hard fail**: `~all` and `-all`, how strictly unlisted mail is treated. ## How Prosyo helps Prosyo sends LinkedIn and email outreach from your own accounts, inside safe daily limits, so authentication you set up here protects every message. It finds verified contacts, writes personal first lines from what each prospect actually did and drafts every reply. [Start a 7-day free trial](https://prosyo.com/pricing/), no card required. ## Related free tools These tools are often used together with the SPF Record Generator. All of them are free and run in your browser. - [SPF Checker](https://prosyo.com/tools/spf-checker/): Validate a published SPF record, count its lookups and catch duplicate records. - [DMARC Generator](https://prosyo.com/tools/dmarc-generator/): Build a DMARC record with reporting and a safe path to p=reject. - [DKIM Checker](https://prosyo.com/tools/dkim-checker/): Find DKIM keys by selector, or scan the common selectors. - [Domain Health Checker](https://prosyo.com/tools/domain-health-checker/): Score MX, SPF, DKIM, DMARC, BIMI, MTA-STS and blocklists in one click. ## Frequently asked questions ### How do I create an SPF record? Tick the services that send email as your domain in the generator above, add any IP addresses you send from and choose a policy. Copy the record it produces and publish it as one TXT record on the root of your domain. ### Can a domain have two SPF records? No. Two or more SPF records cause a permanent error and SPF fails. Combine every sender into a single record. ### What is the SPF 10 lookup limit? Receivers may perform at most 10 DNS lookups while checking SPF. Each include, a, mx and exists mechanism counts, including those nested inside includes. Going over makes SPF fail. ### Should I use ~all or -all? Use ~all (soft fail) for most domains and let DMARC enforce. Use -all only when you are certain every legitimate sender is listed, or for domains that never send email. ### What is the SPF record for Google Workspace? v=spf1 include:_spf.google.com ~all, plus any other services that send as your domain. ### What is the SPF record for Microsoft 365? v=spf1 include:spf.protection.outlook.com ~all, plus any other services that send as your domain. ### How long does an SPF record take to work? Usually minutes after you save it, though DNS caches can hold the old value until its TTL expires. Check it with the SPF Checker. ### Is SPF enough to stop spoofing? No. SPF does not protect the visible From address. Add DKIM and a DMARC record to stop others sending as your domain. ## Ready to Accelerate Your Growth? Launch smarter campaigns, convert more leads, and scale your business with ease — all in one place. [Get Started Now](https://prosyo.com/) [Book a Demo](https://prosyo.com/pricing/)