Mailwarm Email Warmup

SPF Record Generator

Use this free SPF record generator to authorize every service that sends email for your domain. Pick your providers, add any IPs, and we count the DNS lookups for you.

Which services send email for your domain?

Using HubSpot? It gives each account its own include (shown when you connect your sending domain), so paste it into the field below.

Your SPF record

TypeTXTHost / Name
@
Value
v=spf1 ~all

Select at least one service or add an IP address. An SPF record with only "all" authorizes no one.

Replace any existing SPF record instead of adding a second one, then verify it with the SPF checker.

SPF record examples

Common setups you can copy and adapt

Google Workspace only

v=spf1 include:_spf.google.com ~all

The most common record for a domain that only sends from Gmail.

Microsoft 365 plus SendGrid

v=spf1 include:spf.protection.outlook.com include:sendgrid.net ~all

Two senders in one record. Never publish them as two separate SPF records.

Your own server plus a provider

v=spf1 ip4:203.0.113.10 include:mailgun.org -all

A static IP costs no DNS lookups. -all rejects everything not listed.

SPF record syntax explained

What each part of an SPF record does

v=spf1

Required first tag. Marks the TXT record as an SPF record.

include:domain

Authorizes every server in another domain's SPF record, usually your email provider. Costs one lookup plus any inside it.

ip4: / ip6:

Authorizes a specific IP address or range. Costs no DNS lookups.

a / mx

Authorizes the servers in your domain's A or MX records. One lookup each.

~all

Soft fail for everything not listed. Accepted but marked suspicious.

-all

Hard fail for everything not listed. Receivers may reject it.

?all / +all

Neutral or pass for everyone. Both make SPF useless; avoid them.

Stay under the 10 DNS lookup limit

SPF allows at most 10 DNS lookups per check. Each include, a, mx, ptr, exists and redirect costs one, and so does everything inside an include. A single provider include can use several lookups on its own, so the limit fills up faster than the record suggests. Past 10, receivers return a permerror and your mail fails SPF.

  • Remove includes for tools you no longer send from.
  • Replace the include of a server with a fixed address by its ip4 or ip6 range, which costs no lookups.
  • Move bulk or marketing mail to a subdomain with its own SPF record.
  • Avoid ptr entirely; it is slow and deprecated.

After publishing, run the SPF checker to confirm the live record is valid.

SPF Record Generator: Common Questions

Everything you need to create a working SPF record

An SPF record is a DNS TXT record that lists every server allowed to send email for your domain. It always starts with v=spf1 and ends with an all mechanism. Receiving servers compare the sending IP against the list, so mail from unlisted servers can be flagged as spam or rejected.

No, a domain can only have one SPF record. Two TXT records that start with v=spf1 cause a permerror, and receivers may treat every email from your domain as failing SPF. When you add a new email service, merge its include into your existing record instead of publishing a second one.

The difference is how strictly receivers treat mail from servers that aren't listed. ~all is a soft fail: the mail is accepted but marked suspicious. -all is a hard fail: the receiver may reject it outright. Start with ~all while you confirm every sender is listed, then move to -all if you want stricter protection.

To add an SPF record for Google Workspace, create a TXT record on your root domain with the value v=spf1 include:_spf.google.com ~all at your DNS provider. If other services also send email for you, add their includes to the same record. Changes usually take effect within a few hours, sometimes up to 48 hours.

An SPF record can trigger at most 10 DNS lookups. Each include, a, mx, ptr, exists and redirect costs one, and the lookups inside each included record count too. That is why a few includes can add up quickly. This generator counts the real total, including nested lookups, as you build your record.

Authentication is step one

SPF proves who you are. Mailwarm builds the sender reputation that gets your emails into the inbox, with a deliverability audit and an account manager for every customer.

Start Email WarmupView Pricing