SPF Record Generator |
Your SPF record
TXT@the domain itself; for a subdomain such as mg.example.com, mgyourdomain.comv=spf1 ~allyourdomain.com. 3600 IN TXT "v=spf1 ~all"11 characters · No DNS lookups.
What changes compared with the record published now
Nothing: this is the record you already have.
Live check, before you publish
Tick a service to count its DNS lookups.
Biggest lookup costs
To get under 10: remove services you no longer use, send a service's mail from a subdomain with its own record, or replace a and mx with ip4: ranges.
Include tree
An SPF record generator builds the one TXT record that lists the servers allowed to send email for your
domain. Publish it at the domain itself (@), replacing any older v=spf1 record.
How to Publish Your SPF Record
Add or edit one TXT record at the domain with the value above, then check it.
- Open the DNS settings at your DNS host (where your domain's name servers point: the NS lookup tells you).
- Look for a TXT record starting with
v=spf1. If there is one, replace its value; if not, add a TXT record with the name@. - Never leave two
v=spf1records: SPF then fails for every message. - Wait for the TTL (often an hour), then run the SPF record checker.
- Add DKIM in each service and a DMARC record: SPF alone doesn't protect the From address people see.
| DNS host | Name field | Value field |
|---|---|---|
| Cloudflare | @ | The value as shown, without quotes |
| GoDaddy | @ | The value as shown, without quotes |
| Namecheap | @ | The value as shown, without quotes |
| Amazon Route 53 | empty (the domain) | In double quotes ("v=spf1 …"); over 255 characters, split it like the zone file line |
| Your own DNS server (BIND, PowerDNS…) | The zone file line above | |
For a subdomain such as mg.example.com, the name is mg in the example.com zone. A subdomain doesn't inherit the domain's SPF record.
SPF Values for Common Mail Services
Each service gives one include. Several popular senders need none, because receivers check their own return-path domain instead of yours.
| Service | Add to your record | Note |
|---|---|---|
| Google Workspace | include:_spf.google.com | |
| Microsoft 365 | include:spf.protection.outlook.com | GCC High / DoD: include:spf.protection.office365.us; 21Vianet: include:spf.protection.partner.outlook.cn |
| Zoho Mail | include:zohomail.com | Europe: include:zohomail.eu; India: include:zohomail.in; other data centers: the value in Zoho Mail Admin Console |
| Proton Mail | include:_spf.protonmail.ch | |
| Fastmail | include:spf.messagingengine.com | |
| iCloud+ custom domain | include:icloud.com | |
| GoDaddy email | include:secureserver.net | |
| IONOS | include:_spf-eu.ionos.com | US contracts: include:_spf-us.ionos.com |
| Hostinger Email | include:_spf.mail.hostinger.com | |
| Titan Email | include:spf.titan.email | |
| Namecheap Private Email | include:spf.privateemail.com | |
| Rackspace Email | include:emailsrvr.com | |
| OVHcloud email | include:mx.ovh.com | |
| Mimecast | include:eu._netblocks.mimecast.com | Your region: de., us., ca., za. or au._netblocks.mimecast.com; the global _netblocks.mimecast.com costs 6 lookups |
| Mailgun | include:mailgun.org | On the domain you verified in Mailgun (often mg.yourdomain) |
| Mailjet | include:spf.mailjet.com | |
| Elastic Email | include:_spf.elasticemail.com | |
| SMTP2GO | include:spf.smtp2go.com | Compare with Verified Senders in SMTP2GO |
| Campaign Monitor | include:_spf.createsend.com | DMARC passes through DKIM: set it up too |
| MailerLite | include:_spf.mlsend.com | For aligned SPF, the subdomain records MailerLite gives you |
| HubSpot | Your account's value | Like 123456.spf03.hubspotemail.net: Settings, Content, Domains & URLs, Email Sending |
| Salesforce | include:_spf.salesforce.com | |
| Zendesk | include:mail.zendesk.com | |
| Freshdesk | include:email.freshdesk.com | Only with Freshdesk's own mail server; costs several lookups |
| Atlassian (Jira, Confluence) | include:_spf.atlassian.net | |
| Mailchimp · Postmark · Help Scout | Nothing | They send with their own return path. Mailchimp: authenticate the domain (DKIM); Postmark: its custom Return-Path CNAME; Help Scout: not needed since 2024 |
| SendGrid · Amazon SES · Brevo · Shopify · Constant Contact | Usually nothing | SendGrid with Automated Security, SES with its default MAIL FROM, Brevo and Constant Contact on shared IPs, Shopify with its CNAME records: add an include only if the service shows one for your account |
Values from each provider's own setup documentation, checked 12 November 2026. Providers change them rarely, but they do: the live check above shows an include that no longer exists as an error.
Staying Under 10 DNS Lookups
Every include, a and mx costs a lookup, and so does every include inside it. Over 10, SPF fails for all your mail.
- Remove what you no longer use. Old newsletter tools and former mail hosts are the usual cause.
- Leave out services that need no entry (Mailchimp, Postmark, SendGrid with Automated Security): they don't use your record.
- Drop a and mx unless those servers really send mail; list their public IPs with ip4: instead (no lookup).
- Give a service its own subdomain (news.example.com) with its own SPF record, so its lookups don't count against the main domain.
- Be careful with flattening (replacing includes with IP lists): it breaks silently when a provider changes its addresses, unless a service keeps it updated for you.
Built in your browser. To count lookups and test an IP, the record you build (not your other entries) is sent to our server, which resolves its includes through Google Public DNS, like the SPF checker. "Start from my current record" reads the domain's public DNS. Nothing is stored. Last verified 12 November 2026.
Frequently Asked Questions
How do I create an SPF record?
@ (the domain itself).
If the domain already has a record starting with v=spf1, edit that one instead of adding a second.
Can a domain have two SPF records?
v=spf1, receivers return PermError and SPF fails for all your
mail (RFC 7208, section 3.2). Merge them into one: "Start from my current record" above does it for you.
Should I use ~all or -all?
~all (soft fail) asks receivers to accept but mark mail
from other servers; -all (fail) asks them to reject it. Start with ~all while you check
that every service is listed, then switch to -all if you want. Never use +all.
What is the SPF 10 DNS lookup limit?
Do I need to add Mailchimp, SendGrid or Postmark to my SPF record?
What SPF record should a domain that sends no email have?
v=spf1 -all: no server may send for it. Add a DMARC record with p=reject, and a null MX
record (MX 0 .) if the domain receives no email either.
Put this guide into practice