SPF Record Generator
SPF Record Generator concatenates an SPF version marker, manually entered mechanisms, and a selected all qualifier. It does not inspect your DNS, discover mail providers, count DNS lookups, validate mechanism grammar, or publish the record. A mistaken SPF policy can reject legitimate mail, so verify the result with every sender before DNS deployment.
Runs locally — files stay on your deviceWhat is the difference between ~all and -all?
~all marks non-matching senders as softfail; -all declares fail. Enforcement and downstream handling still depend on receivers and DMARC.
SPF authorizes sending hosts for an envelope-from domain
An SPF TXT record starts with v=spf1, evaluates mechanisms from left to right, and commonly ends with an all mechanism carrying a qualifier such as ~ or -.
How it works
Enter the mechanism text, such as a mx include:provider.example, and select ~all, -all, or ?all. The page joins those pieces into one record string.
Key concepts
SPF checks a mail-routing identity
Alignment with the visible From domain is handled through DMARC.
DNS lookup limits matter
Includes and other mechanisms can exceed SPF's lookup budget.
When to use it
- Draft a simple SPF record for review.
- Compare policy endings.
- Prepare text before validation in a DNS-specific tool.
When not to use it
- Do not publish without inventorying every legitimate sender.
- Do not create multiple SPF records for one domain.
- Do not assume SPF alone protects the visible From address.
Worked examples
Host and MX draft
- Input
a mx with ~all- Expected output
v=spf1 a mx ~all
A basic softfail policy is assembled.
Provider include
- Input
include:_spf.example.net with -all- Expected output
v=spf1 include:_spf.example.net -all
The generator does not verify that the include exists.
Empty mechanisms
- Input
No mechanism text; ~all- Expected output
v=spf1 a mx ~all
The current default inserts a mx.
Common mistakes
Publishing an unverified -all
Unknown legitimate senders can fail. Correction: Inventory and test all sending services first.
Adding a second SPF TXT record
Multiple SPF records cause a permanent error. Correction: Maintain one consolidated record.
Ignoring the lookup limit
Nested includes can exceed permitted DNS lookups. Correction: Validate the final DNS evaluation path.
Best practices
- Start from a complete sender inventory.
- Validate syntax and DNS lookup count externally.
- Monitor mail results before enforcing strict policy.
Related operations and differences
CIDR to Range
Choose CIDR to Range when you need to calculate an IPv4 network and broadcast address.; use SPF Record Generator specifically for spf.
cURL Command Builder
Choose cURL Command Builder when you need to build a basic cURL command from manual fields.; use SPF Record Generator specifically for spf.
DMARC Record Generator
Choose DMARC Record Generator when you need to generate a basic DMARC policy record.; use SPF Record Generator specifically for spf.
Fetch Request Builder
Choose Fetch Request Builder when you need to build a browser fetch request snippet.; use SPF Record Generator specifically for spf.
HTTP Header Formatter
Choose HTTP Header Formatter when you need to normalize spacing in pasted HTTP headers.; use SPF Record Generator specifically for spf.
IP Address Validator
Choose IP Address Validator when you need to validate IPv4 or basic IPv6 syntax.; use SPF Record Generator specifically for spf.
Limitations and privacy
- No syntax, DNS, sender, alignment, or lookup-count validation.
- Does not publish DNS.
- Provides only one manually entered mechanism string and an all policy.
The entered network data is processed locally in this browser.
Frequently asked questions
Does it update DNS?
No.
Can a domain have two SPF records?
It should have one SPF record.
Does SPF protect the visible From address by itself?
Not necessarily.
Does the generator validate includes?
No.