SPF Record Generator
Build a valid SPF record for your domain. Select your email providers, add custom IPs, and choose your fail policy. Copy the record and add it to your DNS.
What you publish: one TXT record on the domain itself (Host @), starting v=spf1. A domain can have only one SPF record. The records for Google Workspace, for Google Workspace with Microsoft 365, and for a domain that sends no mail:
v=spf1 include:_spf.google.com ~all v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all v=spf1 -all
Our guide to DMARC for parked and non-sending domains gives the other records a domain that sends no mail needs.
HubSpot gives each account its own include, ending in hubspotemail.net. Find yours in HubSpot under Settings > Content > Domains & URLs > Email Sending, then add it as a custom entry below.
Your SPF record
Add this as a TXT record on your domain's root (@)
v=spf1 ~allValidate and monitor your SPF
Use our SPF Checker to check that your SPF record is correctly deployed, or our SPF Flattener to optimise lookup counts. On paid plans and the free trial, the optional DNS change monitor emails you when the TXT records on your domain, including SPF, change.
Start monitoring freeIncludes for common email providers
| Provider | Mechanism to add | DNS lookups it costs |
|---|---|---|
| Google Workspace | include:_spf.google.com | 1 |
| Microsoft 365 | include:spf.protection.outlook.com | 1 |
| Zoho Mail (US) | include:zoho.com | 5 |
| Zoho Mail (EU) | include:zoho.eu | 2 |
| Mailchimp | include:servers.mcsv.net | 1 |
| SendGrid | include:sendgrid.net | 2 |
| Mailgun | include:mailgun.org | 5 |
| Amazon SES | include:amazonses.com | 1 |
| Brevo (Sendinblue) | include:spf.brevo.com | 1 |
| Freshdesk | include:email.freshdesk.com | 7 |
Lookup counts include the records each include points to, as they stood on 7 October 2026. Providers change their records, so check your finished record with the SPF Checker.
What is SPF?
SPF (Sender Policy Framework) is a DNS-based email authentication method that specifies which mail servers are authorised to send email on behalf of your domain. When a receiving server gets an email, it checks the sender's IP against the SPF record. If the IP is not listed, the email fails SPF and may be rejected or marked as spam.
~all vs -all: which should you use?
The fail policy at the end of your SPF record controls what happens when a server is not listed. End the record with ~all (soft fail) on a domain that sends mail and publishes DMARC. There, the DMARC policy decides what happens to mail that fails: at p=reject you ask receivers to refuse mail that fails DMARC, and each receiver makes the final call (RFC 9989, section 5.4). SPF soft fail is enough for DMARC to evaluate correctly. Some receiving servers apply SPF -all (hard fail) rejections before evaluating DMARC, which can cause legitimate mail to be rejected if you use a sending service that does not align with your SPF. Use -all (hard fail) only on a domain that sends no email at all.
SPF lookup limit
SPF records are limited to 10 DNS lookups. Each include:, a, mx and redirect counts as one lookup, and an include also costs every lookup inside the record it points to. Once evaluation needs an 11th DNS lookup, receivers that follow RFC 7208 stop with a permanent error (PermError), so SPF does not pass for any sender listed after that point. If you are close to the limit, use our SPF Flattener to reduce lookups by resolving includes to IP addresses.
Frequently asked questions
Can I have more than one SPF record?
No. You must have exactly one SPF TXT record per domain. If you have two SPF records, receiving servers will return a PermError and SPF will fail. If you use multiple email providers, combine them into a single record using multiple include: mechanisms.
My provider is not listed: what do I do?
Use the custom IP or include fields to add your provider manually. Most providers publish their own SPF include string in their documentation (for example, include:spf.protection.outlook.com for Microsoft 365). Check your provider's DNS setup guide to find the correct value.
Do I need SPF if I already have DMARC?
Yes. DMARC requires either SPF or DKIM to pass with alignment. SPF is typically the first layer you configure. Without SPF, only DKIM can satisfy DMARC alignment, and DKIM must be configured separately for each sending service. Use both for maximum protection.
How do I verify my SPF record is working?
After publishing, use our DMARC & SPF Checker to verify your SPF record is correctly published and the lookup count is within limits, and to see the SPF alignment mode (aspf=) if your DMARC record sets one. DNS changes can take up to 48 hours to propagate.
What about subdomains: does SPF apply?
SPF applies only to the domain listed in the Return-Path (envelope sender), not necessarily the visible From address. Subdomains that send email need their own SPF records. DMARC's sp= tag controls subdomain policy, but SPF must still be published on each sending subdomain independently.