SPF Record Generator
Build a valid SPF record by picking your senders and enforcement level - copy the DNS TXT record and you're done.
Build your SPF record
SPF is the record that lists which servers may send email for your domain. Pick the services you send through (Google Workspace, Microsoft 365, SendGrid, and so on), add any dedicated IPs, choose an enforcement level, and this generator assembles a valid v=spf1 record for you to paste into your DNS as a single TXT record on your root domain.
Remember there can be only one SPF record per domain, and it's bound by a hard 10 DNS-lookup limit. Each provider include costs at least one lookup, so only add the senders you actually use. After publishing, run your domain through the SPF checker to confirm it's live and under the limit.
Provider include reference
If a sending service is missing from the record, add its include mechanism. These are the standard values for the major providers.
| Provider | Include mechanism |
|---|---|
| Google Workspace | include:_spf.google.com |
| Microsoft 365 | include:spf.protection.outlook.com |
| SendGrid | include:sendgrid.net |
| Mailgun | include:mailgun.org |
| Amazon SES | include:amazonses.com |
| HubSpot | include:spf.hubspot.com |
Mind the 10-lookup budget
include:, a, mx, redirect= and exists: each cost a DNS lookup, and includes nest - include:_spf.google.com is one lookup on paper but resolves to several underneath. Stack Google, Microsoft 365 and a couple of ESPs and you can quietly blow past 10, which turns the whole record into a PermError and breaks SPF entirely.
Where a service sends from a small fixed set of IPs, prefer ip4: entries over an include: - they cost zero lookups. If you're already near the limit, split different email types onto subdomains, each of which gets its own 10-lookup budget.
Publish and verify
One record, one TXT entry, then confirm it's live.
Frequently asked questions
Where do I put the SPF record?
Add it as a TXT record on your root domain in your DNS provider's panel. Use exactly one SPF record per domain - multiple SPF records cause a PermError and break authentication.
Should I use ~all or -all?
~all (softfail) is the safe default - unlisted senders are flagged, not rejected. -all (hardfail) is stricter and best once you're confident every legitimate sender is listed. Never use +all, which authorizes the entire internet.
How many senders can I add?
As many as fit inside the 10 DNS-lookup limit. Each include counts (and nested includes count too), so audit before adding. Use ip4: entries for fixed-IP senders to save lookups.
How do I verify the record works?
Publish it, wait for DNS to propagate (up to a few hours), then run your domain through the SPF checker to confirm the syntax and lookup count.
Next steps
Stop configuring DNS by hand
Cladiant provisions real Google Workspace, Microsoft 365, and Azure Entra mailboxes with SPF, DKIM, and DMARC written and verified on every domain before a single message sends. No DNS headaches, no authentication gaps, one invoice.