SPF record generator
Tick the services that send email from your domain and get a single SPF record to copy into your DNS. It covers cPanel hosting, Microsoft 365, Google Workspace and any other service you add.
Your answers stay in this browser and are never sent to us.
Your result
Fill in the form to begin
Your result appears here straight away. Nothing is uploaded or saved.
How the record is built
Every SPF record starts with v=spf1 and ends with an all rule that says what to do with mail from anywhere not listed. In between, each sender is added:
- cPanel hosting adds
+a +mx, which allows your domain’s own web and mail servers. - Microsoft 365 adds
include:spf.protection.outlook.com. - Google Workspace adds
include:_spf.google.com. - Anything you type in the extra boxes is added as an
include:or anip4:orip6:address.
The tool also counts the lookups the record needs, because SPF allows no more than 10 in total.
Why SPF matters for a small business
Anyone can put your address in the From line of an email. SPF is one of the ways receiving servers such as Gmail and Outlook check whether a message really came from a server you use. Without it, your genuine invoices and quotes are more likely to go to junk, and it’s easier for scammers to pretend to be you.
A common mistake
Businesses that move email to Microsoft 365 or Google Workspace often add a new SPF record without removing the old one. With two records, the check fails for everything. Use this tool to combine them into one, then delete the extra record.
After you add it
Changes can take a little while to be seen. Check the record with our DNS checker, then send a test email to a Gmail address and look for “SPF: PASS” in the original message details.
Questions about this tool
Where do I add the SPF record?
As a TXT record on the domain itself, usually shown as @ or left blank in your DNS editor. On our hosting, use cPanel’s Zone Editor or Email Deliverability. See how to set up SPF, DKIM and DMARC.
Can I have two SPF records?
No. A domain must have exactly one. Two records make the check fail, which is worse than having none. Merge them into one with this tool.
Should I use ~all or -all?
Start with ~all, which marks unlisted mail as suspicious. Move to -all, which asks servers to reject it, only once you’re sure every service that sends as you is in the record.
What is the 10 lookup limit?
Each include, a and mx makes the receiving server look up more DNS records, including the ones nested inside each include. More than 10 and the check fails. If you hit it, remove services you no longer use.
Is SPF enough on its own?
No. Add DKIM and a DMARC record too. Our DMARC generator makes the DMARC record, and the email deliverability checker checks all three.
Related free tools
DMARC record generator
Choose what should happen to email that fails your SPF and DKIM checks, add an address for reports, and get a DMARC record to copy into your DNS.
Open tool → EmailEmail deliverability checker
Emails going to junk, or customers saying they never got your quote? Type your domain to check the four DNS records that decide whether your email is trusted: MX, SPF, DKIM and DMARC.
Open tool → DomainsDNS record checker
Type a domain name to see where its website and email point. The checker looks up the nameservers, website address, www, MX, SPF and DMARC records, and tells you in plain English what's missing or set up wrong.
Open tool →More ways to improve your website.
Get your business website for £47 a month.
We design it, write it, host it and make your changes. No setup fee, no contract, and your first draft commonly the same day.