Build an SPF record

Build one SPF TXT value from explicitly declared include domains and IP networks.

freeworks offlinenothing uploaded

ToolSPF Record Generator

Input

Output

—

Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

AccentBackground

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

How it works

The v=spf1 version term is followed by entered include, ip4, and ip6 mechanisms and exactly one all qualifier. A local count covers direct DNS-triggering mechanisms, while the result warns that RFC evaluation also counts lookups nested inside included policies.

No mail provider is selected automatically; sending domains and networks must come from current sender documentation, and the all qualifier remains an explicit choice.

Worked example

Authorize one include domain and IPv4 network

Build a fail policy without assuming a mail provider

Input

											Domain: example.com
Custom includes: _spf.example.net
Custom IPs: 192.0.2.0/24
Policy: -all

Output

												DNS TXT Record for example.com:

  Name: example.com
  Type: TXT
  Value: v=spf1 include:_spf.example.net ip4:192.0.2.0/24 -all

Policy explanation:
  -all (fail): Emails from unauthorized senders should be rejected

Direct DNS-triggering mechanisms: 1; RFC 7208 limits evaluation to 10 lookups, including lookups inside included records.

When to use this

Domain migrations assemble outbound sources, DNS change reviews inspect TXT values, and incident response removes obsolete sending networks.

Edge cases

Publishing two SPF records at one owner name causes a permanent error instead of combining the policies.
Ten visible include terms can exceed the lookup limit after nested policies are evaluated.
The +all qualifier authorizes every source and defeats sender restriction.

References

RFC 7208