How to use it
- Tick a: the domain's own addresses and mx: the domain's mail servers if the domain sends its own mail.
- Type the networks of your servers in IPv4 networks and IPv6 networks, and any provider's domain in Include these domains.
- Choose the result for other senders under All other senders. -all is the strict choice.
- Copy SPF record (TXT) and publish it as a TXT record at the domain. Check that DNS lookups (limit 10) stays at 10 or fewer.
How a receiver reads an SPF record
An SPF record is a TXT record at the domain it describes. It starts with v=spf1 and then lists terms: a, mx, ip4, ip6 and include, each with an optional qualifier. A receiver checks them from left to right, and the first term that matches gives the result: + pass, - fail, ~ softfail or ? neutral. The + is the default (RFC 7208, section 4.6.2).
- all matches every other sender, and terms after it are ignored (RFC 7208, section 5.1). This page always writes all last.
- When no term matches and there is no redirect, the result is neutral, as if ?all ended the record (section 4.7).
The limit of 10 DNS lookups
The a, mx, ptr, exists, include and redirect terms each cost one DNS lookup, and so do the lookups that an included record makes. A receiver that needs more than 10 lookups for one check returns an error (RFC 7208, section 4.6.4). The ip4 and ip6 terms cost no lookup, which is why a provider that publishes its network ranges can be written as ip4 and ip6 terms instead of an include.
Length and TXT strings
A character-string in a TXT record holds at most 255 characters. A longer record is written as several strings, and a receiver joins them without spaces (RFC 7208, section 3.3). A published record should keep its DNS answer under 512 octets (section 3.4).
Example: a domain that sends from its own servers and one provider
The record v=spf1 a mx ip4:192.0.2.0/24 ip6:2001:db8:1::/48 include:_spf.example.net -all lets the domain's own address records and mail servers send, lets the two networks send, and lets the senders that the record of _spf.example.net allows send. Every other sender fails (-all).
The a, mx and include terms cost one lookup each, and the two network terms cost none, so the record makes 3 lookups. The record of _spf.example.net adds its own lookups, which this page does not count.
| Measure | Value |
|---|---|
| Record | v=spf1 a mx ip4:192.0.2.0/24 ip6:2001:db8:1::/48 include:_spf.example.net -all |
| DNS lookups | 3 of 10 DNS lookups |
| Characters | 78 |
Frequently asked questions
Should I use -all or ~all?
-all tells receivers to fail every sender your record does not list, so it is the strict choice. ~all marks other senders as softfail, which many domains use while they check that their list is complete. If you are not sure the list is complete, start with ~all.
Why does a record with more than 10 lookups fail?
A receiver makes at most 10 DNS lookups for one check, and a check that needs more returns an error (RFC 7208, section 4.6.4). Remove includes you no longer use, or write your provider's published ranges as ip4 and ip6 terms, which cost no lookup.
Does an SPF record have to be a single string?
No. A TXT string holds at most 255 characters, and a longer record is published as several quoted strings that a receiver joins without spaces (RFC 7208, section 3.3). The Split output on this page shows the strings for a record that is too long for one.
What does include do?
include:domain tells a receiver to check the SPF record of that domain as part of yours (RFC 7208, section 5.2). The lookups of that record count toward your limit of 10, so a provider's include may cost more than the one lookup you see here.
Is an SPF record enough to stop spoofed mail?
No. SPF checks the server that sent the message, and DMARC then checks that the domain in the From line matches (RFC 7489, section 3.1). Publish DKIM signatures and a DMARC policy as well.
Does this generator send my domain to anyone?
No. The record is built in your browser from what you type, and nothing is looked up on the network or stored.
Sources
- RFC 7208: Sender Policy Framework (SPF)
- RFC 7489: DMARC, section 3.1 on alignment
- RFC 4291: IP Version 6 Addressing Architecture
Figures and text last checked on Tuesday, November 10, 2026.