Generate an SPF record for your domain
Tick the services that send for your domain and add any custom include, ip4 or ip6. Get one SPF record, its DNS lookup count against the limit of 10, and a check for a second record already on the domain. Free, no account.
Example: Google Workspace plus SendGrid, without a live count. Type your domain and tick your senders above.
SPF record for yourcompany.com
SPF record for yourcompany.com: v=spf1 include:_spf.google.com include:sendgrid.net ~all (2 DNS lookups in the record itself, plus the lookups inside each include, which the live check counts).
| Type | TXT |
|---|---|
| Host / name | yourcompany.com (host @) |
| Value | v=spf1 include:_spf.google.com include:sendgrid.net ~all |
- Note: Email services that send with their own bounce (Return-Path) domain pass SPF on that domain, not yours, and DMARC then passes on DKIM. Add their include when their domain setup page asks for it.
Includes by service
| Service | SPF term |
|---|---|
| Google Workspace | include:_spf.google.com |
| Microsoft 365 | include:spf.protection.outlook.com |
| Zoho Mail | include:zohomail.com |
| SendGrid | include:sendgrid.net |
| Mailgun | include:mailgun.org |
| Amazon SES | include:amazonses.com |
| Postmark | include:spf.mtasv.net |
| Mailchimp | include:servers.mcsv.net |
| HubSpot | account-specific |
Check each against your provider's own domain setup page before you publish; providers sometimes give an account a different include.
The 10-lookup limit
Under RFC 7208 a receiver makes at most 10 DNS lookups to evaluate SPF. include, a, mx, ptr, exists and redirect each cost one, and every include costs the lookups inside it too. Past 10, SPF returns a permanent error and the mail fails SPF. ip4 and ip6 cost nothing. With the live count on, we follow each include up to 3 levels within a 6-second budget.
One record only
A domain must have exactly one TXT record starting v=spf1. Adding a second for a new service breaks SPF for both; merge the includes into one record instead. The live check reads your domain's TXT records to catch this. Nothing is stored.
Get 67 leads free No card. Search free with contacts masked.
SPF, DMARC and MX checkerDKIM checkerDMARC record generatorCold email domain name generatorEmail provider lookup
Questions
v=spf1 include:_spf.google.com ~all, with any other senders added as more includes in the same record.
No. More than one v=spf1 record is a permanent error and SPF fails. Merge every include into one record.
~all (soft fail) is the usual choice and works with DMARC. -all is stricter; use it once every sender is listed. Never use +all.
Remove includes for services that no longer send for you, move a service to a subdomain with its own SPF, or use ip4 and ip6 terms, which cost no lookups.
Only if their setup page asks for it. Services that use their own bounce domain pass SPF there, and your DMARC passes on their DKIM signature.
More free tools
Local business counterNo-website business finderLead list previewCold email template generatorDMARC record generatorCold email graderIcebreaker generatorCold email domain name generatorAll tools