# SPF record generator

> Build your domain's SPF record in seconds, with the services that send for it, without going over the 10 lookup limit. Free, right in your browser.

Source: https://couryo.com/en/tools/spf-generator · Updated 2026-10-21

## What SPF is

SPF is a TXT record in the domain's DNS listing who may send email for it. When Gmail gets a message from `@yourdomain.com`, it checks whether the server that delivered it is on the list. If not, the message loses points and may land in spam.

An SPF record has three parts:

1. `v=spf1`, which says "this is SPF";
2. the mechanisms that authorize servers: `include:` (a service's servers), `ip4:` and `ip6:` (fixed addresses), `mx` (the servers that receive your email) and `a` (the domain's own address);
3. the ending, which says what to do with everyone else: `~all` (be suspicious, the safe start), `-all` (refuse) or `?all` (neutral).

## How to build yours

1. List **every** service that sends email with your domain as the sender: your mailboxes (Google Workspace, Microsoft 365), your marketing tool, your billing system, your website's forms.
2. For each one, take the `include` it gives in its help pages (for example `_spf.google.com` for Google Workspace and `spf.protection.outlook.com` for Microsoft 365).
3. Build the record here and start with `~all`.
4. Publish **a single** TXT record on the domain (the name is `@` or the domain itself, depending on the panel).
5. Check it with the [SPF, DKIM and DMARC checker](https://couryo.com/en/tools/domain-checker).

## The two limits that break SPF

- **One record only.** Two `v=spf1` records on the same name make SPF fail for everyone. If one already exists, edit it instead of adding another.
- **Ten DNS lookups.** Every `include`, `a`, `mx` and `exists` costs a lookup, and the `include`s inside `include`s count too. Over 10, the result is an error. The domain checker counts it for you.

## And at Couryo?

At Couryo, the SPF that counts is the return path's, a subdomain (like `bounces.yourdomain.com`) pointing to us by CNAME. So **your root SPF does not change**, and you spend none of the 10 lookups. See [Domains and DNS](https://couryo.com/en/docs/domains.md).

For AI agents, the `generate_spf` tool is on Couryo's public MCP server, no login: `https://mcp.couryo.com/tools`.

## FAQ

### Should I use ~all or -all?

Start with `~all`. Once DMARC shows every service passes, you can switch to `-all`. With DMARC at `quarantine` or `reject` the difference barely matters: DMARC decides.

### Can I have two SPF records?

No. Only one per name is allowed. Merge all the `include`s into a single record.

### Where do I put the record?

In the DNS panel where your domain lives (Cloudflare, GoDaddy, Namecheap, your host...), as a TXT record on `@` or the domain itself.

### Does SPF alone keep me out of spam?

No. Gmail, Yahoo and Microsoft require SPF and DKIM, with aligned DMARC, from bulk senders. See the [SPF, DKIM and DMARC](https://couryo.com/en/guides/spf-dkim-dmarc.md) guide.