ToolFeather
Developer / SEOBuilt on this page

SPF Record Generator

Build a correct SPF record in a minute. Tick the services that send email for your domain, add your own servers, choose how strict to be, and check the real DNS lookup count before you publish.

Quick presets

SPF Record Generator

Who sends email for your domain?
Email services
Your own servers
Separate several with spaces or commas. Each provider's help pages give the exact value.

Live check: your browser follows each include through Cloudflare's DNS-over-HTTPS resolver (1.1.1.1) and counts the lookups. Nothing passes through ToolFeather. Cloudflare resolver privacy.

Queries your browser sent (0)

These are the exact requests, each one a link. Open one to see the raw JSON answer from the resolver.

    The record is built on this page. The optional live count asks Cloudflare DNS directly from your browser.

    ToolFeather · 22 services
    Scratchpad auto-saved
    Stored in this browser (localStorage)
    Step-by-step~40s read

    How it works — in four simple steps

    No signup and nothing to install — it all runs in your browser.

    1

    Enter your domain

    Used for the host name and the live check.

    2

    Tick your senders

    Add every service that sends mail as you.

    3

    Pick a policy

    ~all with DMARC, or -all for strict.

    4

    Check and publish

    Run the live count, then replace your existing SPF record.

    Pro tip

    Publish one SPF record only. Edit the existing one instead of adding another.

    Features

    22 services built in

    Google Workspace, Microsoft 365, Zoho, Proton, Fastmail, SendGrid, Mailgun, Amazon SES, Postmark, Brevo, Salesforce, Zendesk, Shopify and more.

    Your own servers

    ip4/ip6 addresses and ranges, the domain's a and mx, and any other include.

    Live lookup count

    Follows each include through DNS and reports the true lookup total before you publish.

    Validation

    Checks addresses, CIDR ranges and include domains as you type.

    Ready to publish

    Shows the exact type, host and value to enter at your DNS provider.

    About the SPF Record Generator

    An SPF record is a single TXT record on your domain listing every service that sends email as you. Your mailbox provider is one, but so are your newsletter tool, help desk, CRM, online shop and any server that sends notifications. Leave one out and its mail may fail SPF. Hosted services are added with include: and the value from their help pages. Your own servers go in as ip4: or ip6: addresses, or as a and mx to reuse the domain's existing records.

    The record ends with an all term that says what happens to everyone else. ~all (soft fail) is the common choice alongside DMARC, which does the enforcing. -all (hard fail) asks receivers to reject outright. For a domain that never sends mail, publish v=spf1 -all and nothing else. That's one of the simplest anti-spoofing steps there is.

    Every include costs DNS lookups, and an SPF record may use at most 10 in total, nested includes included. The estimate updates as you tick boxes. Count DNS lookups live then follows each include through Cloudflare's resolver from your browser and reports the real number. The record is built on this page. Publish it as a TXT record at the root of your domain (host @), replacing any SPF record that's already there, because two SPF records break SPF.

    Examples

    Google Workspace + SendGrid → v=spf1 include:_spf.google.com include:sendgrid.net ~all
    Domain that sends no mail → v=spf1 -all

    Frequently asked questions

    5 answers
    Where do I put the SPF record?
    As a TXT record at the root of your domain: host @ (or the bare domain name), with the generated value. Use your DNS provider's dashboard, which isn't necessarily your registrar.
    I already have an SPF record. Do I add a second one?
    No. Edit the existing one and add the new include to it. Two v=spf1 records cause a permerror and SPF fails.
    My newsletter tool says I don't need to add it to SPF. Is that right?
    Often, yes. Services like Mailchimp send from their own bounce domain, so SPF is checked against their domain, not yours. For DMARC you then rely on DKIM signing with your domain, so set up their DKIM records instead.
    How do I stay under 10 lookups?
    Remove services you've stopped using, prefer ip4/ip6 for your own servers, and move bulk or marketing mail to a subdomain (such as news.example.com) with its own SPF record.
    Does ToolFeather see the domains I enter?
    No. Your browser sends each query straight to Cloudflare's 1.1.1.1 or Google Public DNS over HTTPS, without cookies or a referrer. ToolFeather has no server in the path. The resolver you pick handles the query under its own privacy policy. Cloudflare and Google both publish theirs and say they don't sell resolver data. The list under the results shows every request your browser made.