SPF record generator
Tick the services that send email as your domain, add any servers of your own, and copy a single valid SPF record. The lookup counter warns you before you hit the limit of 10.
Your SPF record (TXT record at the root of the domain, host @)
v=spf1 include:spf.protection.outlook.com -all
How to use it
- Tick every service that sends email with your domain in the From address: your mailbox provider, newsletter tool, helpdesk and CRM.
- Add the public IP addresses of any server or printer that sends mail directly.
- Keep
-allunless you are still testing, then copy the record. - At your DNS host, create one TXT record at the root (host
@). If an SPF record already exists, replace it; two SPF records make SPF fail.
The 10-lookup limit
Every include, a, mx and redirect costs one DNS lookup, and so do the includes inside them. Receivers stop at 10 and treat SPF as failed. Remove services you no longer use, and prefer ip4 ranges for your own servers because they cost nothing.
Related guides
Questions people ask
Should I use -all or ~all?
Use ~all (soft fail) for a few days while you confirm every sender is listed, then switch to -all. With DMARC enforcement in place the difference is small, but -all is the clearer signal.
Can I have two SPF records?
No. A domain must have exactly one TXT record starting with v=spf1. Two records cause a permanent error and SPF fails for all mail. Merge them into one.
Why is my SPF record over 10 lookups?
Large providers nest includes inside includes. Remove services that no longer send mail, move bulk mail to a subdomain with its own SPF record, or replace includes for your own servers with ip4 ranges.
Do I need SPF if I have DKIM?
Yes. DMARC passes when either SPF or DKIM passes and aligns with the From domain, and many receivers still check SPF on its own. Publish both.