Choose your senders and policy. Copy the finished TXT record into your DNS, then test it with the checker.
The generator builds text only. It does not change your DNS and it cannot know which services send on your behalf, so list every sender before you publish. Confirm provider include values against the provider's own documentation.
List every system that sends email using your domain: your mailbox provider, your sending service, and anything else that sends on your behalf, such as a CRM, billing system or helpdesk. Marketing tools and website forms are the ones people forget. If a system is missing from the record, its mail can fail SPF.
Check whether your domain already has a record. Publishing a second one does not add to the first; a domain with two SPF records gets an error. Use the checker on your domain first and build the new record to replace the old one.
The generator offers the common cases and lets you add the rest.
The last term tells receivers what to do with mail from servers you did not list.
| Ending | Meaning | When to use it |
|---|---|---|
| ~all | Soft fail: not authorised, but do not reject on SPF alone. | A sensible default while you confirm your list of senders. |
| -all | Hard fail: not authorised. | When you are sure the list is complete. |
| ?all | Neutral: no opinion. | Rarely useful. It gives receivers nothing to act on. |
Create a TXT record at the root of your domain (the host is usually shown as @). Paste the record exactly as generated, without extra quotation marks unless your DNS panel asks for them. If your panel splits long values for you, let it. Keep the time-to-live low, such as 300 seconds, while you test.
Changes are not instant. Resolvers cache the old answer until its time-to-live runs out, so allow time, then check the live record with our SPF checker. The "Test this record" button opens the checker with your generated record already loaded, before you publish it.
The generator keeps count of DNS lookups as you add services. If you go over ten, remove something or move a sender to its own subdomain. A record that is over the limit looks fine and still fails.
SPF is one of three checks. Add DKIM signing for your sending service, then a DMARC record so receivers know what to do when a message fails. Start DMARC at p=none, read the reports for a few weeks, and only then tighten it. Our DMARC generator builds the record and shows a safe rollout.
Tick the services you use, paste any include values from other providers, and list your own server addresses.
~all is the usual starting point. Move to -all when you are sure every sender is listed.
Publish it as a single TXT record at the root of your domain. Replace any existing SPF record instead of adding a second one.
Use the checker to see the real lookup count, because every provider include uses lookups of its own.
List every system that sends email as your domain, add one include or ip4/ip6 entry for each, and end the record with ~all. Publish the result as a single TXT record at the root of your domain. This generator builds the text for you.
Most teams start with ~all (soft fail) while they confirm that every sender is listed, and consider -all (hard fail) once they are sure. DMARC with DKIM gives additional protection whichever you choose.
No. A domain must publish exactly one SPF record. Two records cause a permanent error. If you add a new sender, add its include to the existing record instead of creating a second one.
Each provider documents its own value. For MigoSMTP, copy the SPF value shown in your dashboard. For Google Workspace and Microsoft 365 the generator offers the values from their public documentation; confirm them against the provider's current help page before you publish.
As many as fit within the limit of ten DNS lookups for the whole record, counting the lookups inside each provider's own record. Publish the record, then run the SPF record checker to see the real total.
It depends on the TTL of the record. Many DNS providers use values from a few minutes to a few hours, and some resolvers cache longer. After you publish, check again with the checker and wait for the old value to expire.
Run the checker to confirm the record is valid and to see how many of the ten lookups it uses.
Create an account, add your domain and send your first email.