Free SPF record generator

1. Tick your email provider: Google Workspace or Microsoft 365.
2. Add the include of every other service that sends as your domain, such as your cold email tool, CRM, newsletter or billing system. Each one documents its include.
3. Add ip4 or ip6 addresses only for mail servers you run yourself.
4. Choose ~all or -all, then copy the record.
5. Publish it as a TXT record on the domain you send from, replacing your current SPF record, and run the SPF checker.

Every include, a, mx, ptr, exists and redirect costs a DNS lookup, and so does every include inside an include. Above 10, SPF fails with a permanent error. ip4, ip6 and all cost nothing.

The meter asks DNS for each include’s record as you add it, so the count is today’s real number: providers change their records over time. If you are close to 10:

• remove services that no longer send for you;
• move a sending tool to a subdomain, such as mail.yourdomain.com, with its own SPF record;
• replace an include with ip4 or ip6 ranges only when the vendor documents them as stable.

Both tell receivers that servers you did not list are not yours. Google’s setup guide recommends ~all (soft fail). Microsoft recommends -all (fail) for domains that also have DKIM and DMARC, so DMARC can act on mail that fails SPF. Avoid +all, which lets any server send as you, and ?all, which says nothing.

SPF checks the envelope sender (the Return-Path), which many sending tools set to their own domain. Then SPF passes for them, not for you, and does not help your DMARC. Set up DKIM on your domain in each tool as well.

SPF does not carry over: each domain and subdomain you send from needs its own record. If you send cold email from a separate domain, build a record for it too, then add DMARC with the DMARC record generator.