SPF record generator

An SPF record is one TXT record on the domain you send from, starting v=spf1. After that come the servers allowed to send mail for the domain: ip4 and ip6 entries name addresses directly, and include points at a provider's own list, which is how most services are authorized. The all at the end says what receivers should make of mail from anywhere else.

This generator writes the addresses first and the includes after them. Receivers evaluate the record from left to right and stop at the first match, so mail from a server listed by its address passes before a single include is fetched.

A domain must publish exactly one record starting v=spf1. Adding a service means editing that record, never adding a second one: with two, RFC 7208 has receivers return a permanent error, and SPF fails for all of the domain's mail.

Enter your domain and the generator reads what it publishes today. It tells you the new record replaces the old one, lists any sender the old record allowed that the new one would drop, and flags a domain that already has two records or ends in +all, before anything is published.

Every include, a and mx in the record costs one DNS lookup when a receiver evaluates it, and so does every include inside the records those includes point at. Past 10, receivers stop and return a permanent error, and SPF fails. Some providers' includes cost more than one, because they nest further includes of their own.

The generator resolves each include live, with the same code as the SPF checker on this site, and shows the whole tree with its count. The number you see here is the number the checker finds once the record is published. ip4 and ip6 entries cost nothing, which is why they come first.

SPF is checked against the envelope sender, the address that bounces return to, and not every service sends with yours. Amazon SES, for one, uses a subdomain of amazonses.com unless you set up a custom MAIL FROM domain, and then its SPF record goes on that subdomain of yours, not on your main domain. An include for such a service in your main record spends a lookup and does nothing for that service's mail.

Every provider in the list follows its own documentation. When that puts the provider's SPF somewhere other than your main domain, says no include is needed, or gives each account an include of its own, the generator leaves it out of the record and says why.

The ending decides what happens to mail from servers the record does not list. With ~all, a soft fail, receivers treat it with suspicion; with -all, a hard fail, it fails SPF outright. DMARC counts the two the same way. Start with ~all while you are still finding every service that sends for the domain, and move to -all once the record is complete.

The generator never writes ?all, which tells receivers the record has no opinion about anyone else, or +all, which lets every server on the internet pass SPF as you.