SPF Record Builder
Build a basic SPF TXT record from authorized IP addresses, include domains, A/MX mechanisms, and a default policy—without memorizing SPF syntax.
Build a basic SPF TXT value from the systems that are actually allowed to send mail for your domain. Add IPv4 addresses, include domains, and optional A or MX mechanisms, then choose the policy that should apply to unmatched senders. Use the generated value as a starting point, not a blind replacement: a domain should normally publish one SPF policy per hostname, and long include chains can exceed SPF’s DNS lookup limits.
Build a basic SPF record without memorizing the syntax
SPF is a DNS-based email authentication mechanism that tells receiving mail systems which servers are authorized to send mail using your domain. This builder combines common mechanisms such as IP addresses, a, mx, and include into one TXT-record value.
A simple SPF example
A domain that authorizes its own A record, MX hosts, and Google Workspace might use a value similar to:
v=spf1 a mx include:_spf.google.com ~allThe exact record for your domain should come from the services that actually send mail for you.
Why a domain should normally have one SPF record
Publishing multiple TXT records that each start with v=spf1 does not create a combined policy. When you add a new sender, its mechanism usually needs to be merged into the existing SPF record instead of creating a second one.
The DNS lookup limit matters
SPF evaluation has a limit on DNS-querying mechanisms. Long chains of include, a, mx, redirect, and related mechanisms can exceed that limit and cause SPF to return a permanent error. Do not keep adding providers without reviewing the final policy.
Choose the ending policy carefully
~allis a soft-fail policy commonly used while a configuration is being verified.-allstates that senders not matched by the record are unauthorized and should only be used when the sender inventory is complete.?allis neutral and provides little enforcement value.
SPF is only one part of email authentication
SPF works best alongside DKIM and DMARC. Passing SPF alone does not guarantee delivery to the inbox, and SPF alignment for DMARC depends on the domain used in the authenticated mail path.
Frequently asked questions
Can SPF be a CNAME record?
SPF policy is normally published as a TXT record at the domain being checked.
Can I copy another company’s SPF record?
No. Your record should authorize only the systems that send mail for your own domain.