Spf Record Generator
Fast, accurate and free online spf record generator tool running directly in your browser.
-
1Enter data
Enter content, paste text or load a file from disk. -
2Click the button
The tool will immediately process your data in the browser. -
3Get the result
Copy the finished text or save the file to your device.
return "Result ready in 0.1s";
}
Rate this tool:
Related tools
Other tools you may find usefulSPF record generator - email protection against email spoofing
SPF (Sender Policy Framework) is a DNS TXT record specifying which servers have the right to send email on behalf of your domain. Without SPF, spammers can spoof your domain. The tool creates a valid SPF record based on your settings and validates the syntax.
What is SPF and how does it work
SPF: TXT DNS record for the domain, e.g. v=spf1 include:_spf.google.com ip4:203.0.113.1 ~all. Mechanism of operation: (1) Email sent from the X server on behalf of [email protected]. (2) The recipient server asks DNS: what is the SPF record of domain.pl? (3) Checks if the X server is on the list. (4) Result: pass, fail, softfail, neutral. The result influences the decision to accept/reject the email.
SPF record syntax
v=spf1: version (always spf1). Mechanisms: ip4:x.x.x.x (specific IP), ip6:..., a (A domain record), mx (MX domain record), include:domain.com (delegation to another SPF), all (others). Qualifiers: + (pass, default), - (fail), ~ (softfail), ? (neutral). Example: v=spf1 ip4:1.2.3.4 include:sendgrid.net -all. -all = discard all others.
SPF for popular services
Google Workspace: include:_spf.google.com. Microsoft 365: include:spf.protection.outlook.com. SendGrid: include:sendgrid.net. Mailchimp: include:servers.mcsv.net. Amazon SES: include:amazonses.com. OVH: include:mx.ovh.com. Hetzner: include:_spf.hetzner.com. Combination: v=spf1 include:_spf.google.com include:sendgrid.net ~all.
SPF limits and traps
Max 10 DNS lookups: each include, a, mx = 1 lookup. Exceed = permerror (SPF fail). Flatten SPF: replace include with ip4/ip6 to reduce lookups. Max 2 void lookups. TXT record length: max 255 characters in one string, but multiple strings possible. Subdomains: SPF for domain.pl does not include sub.domain.pl - a separate record is needed.
FAQ
What is the difference between -all, ~all and ?all?
-all (fail): reject email from servers not on the list. Strict, may block legitimate emails from unknown servers. ~all (softfail): mark suspect but deliver. The most common choice at the beginning. ?all (neutral): no rating. +all (pass all): anyone can send - dangerous! Recommendation: start with ~all, move to -all when sure the server list is complete.
What is DMARC and how does it connect to SPF?
DMARC (Domain-based Message Authentication Reporting and Conformance): policy on what to do when SPF or DKIM fail. Record: _dmarc.domena.pl TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]". Policies: p=none (monitor), p=quarantine (spam folder), p=reject. SPF + DKIM + DMARC = full protection. DMARC requires alignment: From: domain = SPF/DKIM domain.
How to test an SPF record?
dig TXT domain.pl | grep spf (Linux/Mac). nslookup -type=TXT domain.pl (Windows). Online: MXToolbox SPF Check, Mail-tester.com (send email and check result). Test from a specific server: kmail-checker. Check the headers of the received email: Authentication-Results: spf=pass or spf=fail.
How long does it take for an SPF record to propagate?
DNS record TTL: typically 300-3600 seconds (5-60 minutes). Global propagation: up to 48 hours in theory, 30 minutes in practice for most providers. During a change: set TTL=300 one hour before the change to speed up propagation. Check propagation: dnschecker.org (multiple global locations).