Skip to content

Free SPF record generator

Tick the services that send email as your domain, add any servers of your own, and get one valid SPF record. The DNS lookup count updates as you go, so you stay under the limit of 10.

  • Free, no sign-up
  • Live lookup counter
  • Loads your current record
Build your record Counted against live DNS
Services that send as your domain
Your own servers
Separate with spaces. Services such as HubSpot give each customer a unique include.

How to build an SPF record that works

  1. List every service that sends email as your domain: mailboxes, website forms, accounting, CRM, newsletters and support desks.
  2. Tick each one above, or add its include from the provider’s set-up guide.
  3. Replace your existing SPF record with the new one. Never publish two.
  4. Check it with the SPF checker, then confirm in DMARC reports that each service passes.

About this tool

  • Provider includes were checked against live DNS in October 2026. Providers do change them, so confirm with each provider’s set-up guide.
  • The lookup counter follows every include in live DNS, the way receivers do.
  • Nothing you enter is sent to MailMarq. DNS lookups go from your browser to Google Public DNS.

SPF record questions

Short answers to what people ask most when building an SPF record.

What is the SPF record for Microsoft 365?

For a domain that sends only through Microsoft 365, publish v=spf1 include:spf.protection.outlook.com -all, or ~all once DMARC is enforcing. If other services send as your domain, add them to the same record rather than publishing a second one.

What is the SPF record for Google Workspace?

Publish v=spf1 include:_spf.google.com ~all. Google’s include currently costs one DNS lookup, but other services can cost several, so check the total with the counter above when you add them.

Does every service need to be in my SPF record?

Only services that send with your domain as the envelope sender. Many newsletter and CRM platforms use their own bounce domain, so your SPF record never applies to them. For those, DKIM signing with your domain is what makes DMARC pass. Check each provider’s authentication guide.

How do I combine two SPF records?

Take every mechanism from both, keep one v=spf1 at the start and one all at the end, and publish the result as a single TXT record. Enter your domain above and choose Load my current record to start from what you already have.

What is the difference between include, a and mx?

include pulls in another domain’s SPF record and is how email services are added. a authorises the IP addresses of a hostname, by default your own domain’s website. mx authorises your domain’s incoming mail servers. Each costs one DNS lookup, so use a and mx only if those servers really send email.

How many includes can an SPF record have?

There is no fixed number of includes, but the whole record may use at most 10 DNS lookups, and each include can contain more. Two or three large providers can use up the limit, which is why the counter follows every nested include in live DNS.

More free tools

DMARC checkerCheck DMARC, SPF, DKIM and MX in one pass, with a plain-language verdict.SPF checkerValidate your SPF record, count DNS lookups and map every include.DKIM checkerFind DKIM keys at common selectors and check their length and flags.DMARC generatorBuild a valid DMARC record with every option explained.Email header analyserSee if a message passed SPF, DKIM and DMARC, and where it was delayed.All free toolsEvery checker, generator and analyser in one place.

Too many services to keep track of?

MailMarq maps every service sending as your domain from your DMARC reports, keeps SPF under the limit and DKIM in place for each one, and alerts you when something new appears. From R3,290 a year.

Scroll to Top