SPF record generator
Build an SPF TXT record for the services that send your mail, then check the SPF record a domain publishes today.
- Build and check
- Free, no sign-up
Build the TXT record, then check the SPF record this domain publishes today.
Mail services
More senders
Building the record stays in this tab. Checking a domain sends that name to Cloudflare DNS and reads the TXT records published today. Free to use, no account. More seo tools
How to use it
- Enter the domain and tick the mail services that send for it.
- Add addresses or a redirect under More senders, and read the TXT record.
- Press Check the published record to read the TXT record that domain publishes today.
How the record is built
The record starts with v=spf1. Ticked services add an include for that service’s SPF host. IPv4 and IPv6 addresses, the domain’s own A record and its MX servers can be added too. The last mechanism is usually -all, which means fail for every other server. ~all is a soft fail, ?all is neutral, and +all passes every host. A redirect is written only when you leave the all mechanism empty, because a record that already has all ignores redirect.
Check the published record asks Cloudflare’s public DNS for the TXT records at that domain. The walk follows each include, stops at all, and counts the lookups a receiver counts: include, a, mx, ptr, exists and redirect, up to 10. The domain’s own TXT query is free. An mx mechanism counts as one lookup here; a receiver also looks up each mail server. Two SPF records on one host are a permanent error. A value longer than 255 characters is shown in the quoted pieces a TXT record stores.
Private by design
Privacy
The record is built in this tab. Checking a domain sends that domain name to Cloudflare’s public DNS and reads the TXT records it publishes today.
This page also shows Google ads, which can use cookies. Privacy and cookies explains how.
Questions
What does an SPF record do?
It is a TXT record that names the servers allowed to send mail for the domain. Receivers read it and compare the sending server with that list.
What does -all mean?
Fail for every server the earlier mechanisms missed. ~all is a soft fail, ?all is neutral, and +all passes every host.
How does the check count lookups?
Include, a, mx, ptr, exists and redirect each count, up to 10. The domain’s own TXT query is free. Past 10, a receiver stops with a permanent error. An mx is counted once here.
What if the domain already publishes SPF?
Check the published record shows the TXT record there today, follows the includes, and names a loop or a second SPF record when it finds one.