How the record is built
An SPF record is a single TXT record on the apex domain that starts with v=spf1 and ends with an all mechanism. In between it lists who may send: include for providers, ip4 and ip6 for your own addresses, mx for your own mail servers. The generator keeps this order and adds each mechanism only once.
The important part is to capture every sender, not just the mail provider: newsletter tools, ticket systems, CRMs, invoicing software, website forms and printers often send with the domain as the sender. Anyone missing ends up as softfail or fail at the receiver.
Keeping the lookup limit
Receivers perform at most ten DNS queries to evaluate an SPF record. include, a, mx and redirect count, each including the queries the included record triggers itself. The generator uses the known values of the providers (Google Workspace four, Microsoft 365 two) and warns as soon as the sum exceeds ten. Then the only fix is cutting: remove unused services or list fixed addresses with ip4 instead of include.
-all or ~all
With -all (hard fail) you tell receivers to reject unlisted senders. With ~all (soft fail) they are only flagged. For a new or incomplete list ~all is the safe start; once DMARC reports show that every sender is covered, switch to -all. ?all and +all offer no protection and are not offered by the generator.
Publish and check
Publish the generated value as a TXT record on the apex domain (name @ or empty). If a record starting with v=spf1 already exists, replace it rather than adding a second one: two SPF records are a permanent error. After saving, run the SPF checker; it resolves every include and shows the actual lookup count.
Frequently asked questions
- My provider is not in the list.
- Enter its include value under "More includes". Providers publish the value in their help under SPF or domain authentication.
- Do I need mx with Microsoft 365 or Google Workspace?
- No. The provider include covers its servers. mx only makes sense when your own mail servers send and are also listed as MX.
- Can I create several SPF records, one per service?
- No. There must be exactly one TXT record with v=spf1 per domain. All mechanisms belong in that one record.