Free tool
SPF record generator
Tick the services that send email as your domain and get a correct SPF record to paste into your DNS — with a warning if it will break the 10-lookup limit.
Runs entirely in your browser. Nothing you type is sent to us.
How to use your SPF record
- List every service that sends email as your domain: your mail platform, newsletter tool, invoicing and accounts software, CRM, website and helpdesk.
- Tick or add each one above. If a service is not listed, its help pages will give its include.
- In your DNS, replace any existing SPF record with the new one. Never publish two.
- Run the SPF checker to confirm it is live and under the 10-lookup limit.
- Add DKIM and a DMARC record — SPF alone does not stop spoofing. Use our DMARC record generator next.
Our guide to SPF, DKIM and DMARC explains how the three work together.
Questions
About SPF records
Where do I put my SPF record?
In your domain’s DNS, as a TXT record on the domain itself — the host is usually shown as “@” or left blank. Replace any existing SPF record rather than adding a second one: a domain may only have one.
Should I use ~all or -all?
Start with ~all (soft fail) while you confirm every service that sends as you is listed. Once your DMARC reports show nothing legitimate failing, -all (fail) is stricter. With DMARC at quarantine or reject, the difference matters less, because DMARC decides what happens to failing mail.
What is the 10-lookup limit?
Receiving servers will perform at most 10 DNS lookups to evaluate your SPF record. Each include, a, mx, ptr and exists mechanism costs at least one, and includes can contain further includes. Go over 10 and SPF fails for every message. Remove services you no longer use, and check the published record with our email security checker.
My service is not in the list. What do I use?
The service’s own help pages will give its SPF include, usually under “domain authentication” or “sender authentication”. Add it in the extra includes box. Some services, such as many CRMs and newsletter platforms, authenticate with DKIM on your domain instead and do not need an SPF include at all.
Rather have it done for you?
SPF, DKIM and DMARC are set up and monitored for every MyExchangeServer customer. Or send us your current records for a second opinion.
- Free assisted migration
- No set-up fee, no minimum term
- UK data centres, UK engineers