WITTCO
Login

Free IT Toolbox

SPF record generator.

SPF is the public list of servers allowed to send email for your domain. Tick the services you use, add any servers of your own, and get one record, with a warning when it is likely over the 10-lookup limit in the SPF standard (RFC 7208). It runs entirely in your browser: nothing you type is sent to our server, and it makes no DNS lookups.

The bare domain your email comes from, without https:// or www. The record goes on the root domain itself.

Which services send mail for this domain?

Tick every service that sends as your domain, including the one your team uses for everyday email. Miss one and its mail can fail SPF, so include marketing, invoicing and notification senders too.

Type the include domain exactly as the setup page from your provider gives it. More than one? Separate them with commas.

Do your own servers send mail for this domain?

One per line, or separated by commas. Ranges use CIDR, like /24.

Only if your servers send over IPv6. Most small businesses can leave this empty.

How strict should receivers be with everyone else?

Your SPF record

Enter your domain above and your record will appear here, ready to copy.

A safe order

Publish soft, verify, then tighten.

An SPF record that forgets a real sender can send invoices and notifications to spam. This order avoids that.

Step 1: list every sender

Tick everything that sends as your domain, including accounting, marketing and notification services. Anything you miss can fail SPF once you tighten up, and the record goes on the root domain as a single TXT record.

Step 2: publish with soft fail (~all)

Soft fail marks unlisted senders as suspicious instead of rejecting them. Watch for a week or two (your DMARC reports will show who is failing) and add anything you missed.

Step 3: switch to hard fail (-all)

Once every real sender passes, change ~all to -all so receivers are asked to reject mail from anywhere not on your list. Keep the record as one TXT record: a domain with two SPF records gets neither enforced.

Two rules from the SPF standard (RFC 7208) catch people out. A check may use at most 10 DNS lookups, and every include, a, mx and redirect counts, including the lookups inside included records. And a domain gets exactly one SPF record: publishing a second one makes receivers ignore both.

Where it goes

One TXT record on the root domain.

Unlike DMARC, the SPF record sits on the domain itself, which most DNS hosts show as @. If a record starting with v=spf1 is already there, replace it rather than adding a second.

GoDaddy

In DNS Records, add a TXT record. Put @ in the Name field for the root domain and paste the value as-is.

Cloudflare

Under DNS, add a TXT record named @ (Cloudflare shows the root as your domain) and paste the value into the Content field.

Namecheap

In Advanced DNS, add a TXT record with Host set to @ and paste the value. Leave the TTL on Automatic unless you have a reason to change it.

AWS Route 53

In the console the Record name box already shows your domain as a suffix, so leave it empty for the root domain. Enter the value wrapped in double quotes, as AWS documents for TXT record values.

SPF works alongside DMARC, and our DMARC record generator builds the companion record that tells receivers what to do when checks fail. To see what your records look like from outside before and after, run the Free Technology Checkup.

See everything in the Free IT Toolbox

Related tools: DMARC Record Generator.

Not sure who sends as you?

Forgotten senders are the usual reason SPF goes sideways. Book a free assessment and we will map them from your DMARC reports with you, in plain English.

Book a Free Assessment(985) 370-9488
Prefer email? support@getwittco.com