SPF Record Generator

List every service that sends email for your domain — your mail platform, marketing tools, and transactional senders — then publish a single TXT record at your root domain starting with v=spf1 and ending with an 'all' qualifier. This generator builds that string from common providers and your own IPs.

The SPF specification requires exactly one v=spf1 TXT record per domain. Publishing two causes a permerror that breaks authentication for all your mail. Combine every sending source into one record using multiple include: and ip4:/ip6: mechanisms.

Each include:, a, mx, ptr, exists, and redirect counts as a DNS lookup, capped at 10. If you exceed it, replace some includes with their published IP ranges (ip4:/ip6:), remove unused senders, or use an SPF-flattening service. The generator shows your live lookup count.

Start with ~all (soft fail) while you confirm every legitimate sender is listed, so nothing is rejected during rollout. Once your DMARC reports show all real mail passing, switch to -all (hard fail) for the strongest protection against spoofing.

For a domain that sends only through Google Workspace, publish this as a TXT record at your root domain: v=spf1 include:_spf.google.com ~all. The include:_spf.google.com token pulls in Google's current sending IP ranges, so you never have to list those addresses yourself. If you also send through other services, add each provider's include to the same record rather than creating a second one.

Chain each provider's include mechanism into the same v=spf1 record, one after another, before the closing all qualifier. For example, a domain sending through both Google Workspace and SendGrid uses v=spf1 include:_spf.google.com include:sendgrid.net ~all. Order does not affect correctness, but every sender you actually use must appear, and each provider publishes its own include value, so copy those from the provider's own documentation rather than guessing.

The +all qualifier tells receivers that any server on the internet is authorized to send mail as your domain, which turns SPF off and invites spoofing. It is the single most dangerous value you can publish, because it makes every forged message pass SPF. Always end with a restrictive qualifier that names only your real senders, never +all.

First confirm nothing still sends through that provider by checking recent mail logs and your DMARC aggregate reports for passing traffic tied to its IPs. Once you are sure it is idle, delete that provider's include or ip4/ip6 entry from the record, leaving the rest of the string intact, and republish. Removing an include that is still in use will cause that provider's mail to fail authentication, so verify before you cut.