dotvitals

SPF Record Generator

Answer a few questions about who sends your mail and get a valid SPF record with provider-specific instructions.

SPF is checked against the exact name in the envelope sender, so `example.com` and `mail.example.com` each need their own record — a record on the parent authorises nothing for a subdomain that sends.

About the spf record generator

Writing an SPF record by hand means knowing the exact include mechanism each mail provider expects, in the right order, ending with a single correct all qualifier, and keeping the whole thing under the ten-lookup limit from RFC 7208. This generator turns that into a short guided form instead: pick the providers and servers that actually send your mail, and it assembles the record for you.

It supports common providers such as Google Workspace, Microsoft 365, Amazon SES, SendGrid and Mailgun by name, along with a custom option for a provider not on the list or your own server's IP addresses, and combines whatever you select into one syntactically valid v=spf1 record. As you add senders, the generator counts DNS lookups live and warns you before the record would exceed the limit, so you find out during setup rather than after publishing when mail starts failing with a permanent error that is harder to diagnose after the fact.

The output includes exactly where to paste it: a TXT record at the root (@) of your domain, and it links to the specific steps for common DNS hosts so the last step is not left to guesswork after the record itself is correct. Because the record only takes effect once it is actually published and the TTL of any previous SPF record has expired, testing the generated record with the SPF checker before considering the rollout complete is worth the extra minute it takes.

Common questions

Which providers are supported?
Google Workspace, Microsoft 365, Amazon SES, SendGrid, Mailgun and your own mail server, along with a custom option for any provider not listed by name.
Will it exceed the lookup limit?
The generator counts DNS lookups live as you add senders and warns you before you publish a record that would exceed the RFC 7208 limit of ten.
Where do I paste the record?
In your DNS host's control panel, as a TXT record on the root (@) of your domain. Step-by-step instructions are shown for common hosts.
Can I generate a record for a subdomain that sends mail separately?
Yes, run the generator again for that subdomain specifically; SPF is evaluated per exact hostname, so a subdomain needs its own record unless it redirects to the parent's.