SPF Record Builder
Add your sending sources, set the catch-all, and get the exact SPF TXT record for your root domain.
Quick Add — Common Providers
Mechanisms
0/10 lookupsNo mechanisms added yet. Use the Quick Add buttons or add one below.
Default / Catch-All (all)
SoftFail (~all) — Messages from unlisted sources are treated as suspicious. Most common choice.
DNS TXT Record
Add this to yourdomain.com (root domain)
v=spf1 ~all
What an SPF record does
Sender Policy Framework (SPF) is a TXT record published at your domain's root that lists every server or service authorized to send mail on your behalf — your own mail server, Google Workspace, a marketing platform, a CRM. When a receiving server gets a message claiming to be from your domain, it checks the connecting IP against this list. If the IP isn't listed, the message fails SPF, which is one of the two checks DMARC relies on to decide whether mail is legitimate.
How to use the record this tool generates
SPF is published at the root of your domain, not a subdomain — create a TXT record onyourdomain.com itself with the value shown above. If a record already exists, don't add a second one: merge the mechanisms into the existing record instead, since receivers only honor a single SPF TXT record per domain.
Common mistakes
- Publishing two SPF records instead of merging mechanisms into one — this causes a permanent SPF error.
- Exceeding the 10 DNS lookup limit. Each
include,a,mx, andexistsmechanism counts as one lookup — go over and the record fails to evaluate entirely. Use the SPF Flattener if you're close to the limit. - Leaving off a catch-all, or using
+all— that authorizes every server on the internet to send as you, which defeats the purpose of SPF.
Keep an eye on this automatically
A one-off check tells you how things look right now. DMARC.WS collects your aggregate reports continuously, shows you which senders are failing authentication, and alerts you when something changes.
Free plan includes 5 domains. No card required.