OneTaskBy Tim King · Updated
SPF Record Generator
Tick Common Email Services, Add Your Own IPs and Count DNS Lookups
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the SPF Record Generator works
This SPF record generator builds the TXT record that tells receiving mail servers which services may send email for your domain. Pick the providers you use, add your own servers and IP ranges, and publish the result so your mail is less likely to be marked as spam or spoofed.
How the SPF record generator builds the record
SPF (Sender Policy Framework) is a single TXT record on your domain that starts with v=spf1 and lists allowed senders. Each provider you pick adds its include, the a and mx options allow your own web and mail servers, and IP addresses become ip4 or ip6 entries. The record ends with an all rule saying what to do with mail from anywhere else.
Receivers must do a DNS lookup for every include, a and mx, and SPF allows only 10 in total, including the lookups inside each include. The counter shows your direct lookups. Going over the limit makes the whole record fail, so drop services you no longer use.
Start with ~all, which marks unlisted mail as suspicious without rejecting it. Once DMARC reports show every real sender passing, you can move to -all. Only ever publish one SPF record per domain.
FAQ
Why is ~all recommended over -all?
With DMARC in place, receivers act on your DMARC policy rather than the SPF result, so -all adds little and can cause bounces for forwarded mail. ~all is the safer default for most domains.
I use a service that is not listed. What do I add?
Look in the service's help pages for its SPF include, which usually looks like include:spf.example.com, and paste the domain into the other include domains box. Some services give IP ranges instead, which go in the IP box.
Does SPF alone stop people spoofing my domain?
No. SPF checks the hidden bounce address, not the From address people see. You need DKIM signing and a DMARC record as well, which ties both checks to the visible From address and tells receivers what to do on failure.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
DMARC Record Generator
Build a DMARC record with the right policy and report addresses.
Email Header Analyzer
Trace an email's route and check its SPF, DKIM and DMARC results.
DMARC Report Viewer
Turn a DMARC aggregate XML report into a readable table.
Email DNS Record Checker
Check an SPF, DKIM or DMARC record before you publish it.
.env File Checker
Lint a .env file for syntax errors, duplicates and weak secrets.