Check your senders
Tick every service that sends email for you, from Google Workspace to SendGrid. We add the right include for each one automatically.
Check the services you send from, add any extra IP addresses, and we assemble a copy-ready SPF TXT record for your DNS.
Every mechanism is explained in plain English, so you know exactly what you’re publishing.
yourdomain.com
Your SPF record
v=spf1 ~all
Tick every service that sends email for you, from Google Workspace to SendGrid. We add the right include for each one automatically.
Authorize your own mail servers with a and mx, and add any static IP addresses that send on your behalf. Nothing legitimate should be left out.
We assemble a valid SPF TXT record as you go. Copy it, then create a TXT record at your domain root in your DNS settings.
Save the record with your DNS provider, wait for it to propagate, then confirm your setup with the Email Deliverability Checker to make sure SPF, DKIM, and DMARC all pass.
SPF only works when every sender is listed and you stay under the 10-lookup limit, and getting there by hand across your DNS is fiddly and easy to break. Stop wrestling with DNS records. Connect your domain to Hunter and we help you get email authentication set up so your emails land in the inbox.
Set up your domainSPF tells receivers which servers may send email as your domain. It’s the first line of defense against spoofing and the foundation deliverability is built on.
Gmail and Yahoo require SPF for bulk senders. A valid record keeps your emails out of spam and delivered.
SPF lets receivers reject mail from servers you never authorized, protecting your brand from phishing and impersonation.
List exactly which providers and IP addresses may send email for your domain, so only your real senders get through.
Everything you need to know about SPF records and how to set them up.
An SPF record is a DNS TXT record that lists every server allowed to send email for your domain. When a message arrives, the receiving server checks whether it came from an authorized source. It always starts with v=spf1 and ends with an all-qualifier such as -all, and it’s published at your domain root.
Check the services you send from above, add any extra IP addresses or custom includes, pick an enforcement level, and copy the generated record. Then create a TXT record at your domain root in your DNS settings and paste the record as its value. Save it and it goes live once DNS propagates.
A safe starting point is to include only the providers you actually send from, for example v=spf1 include:_spf.google.com ~all for Google Workspace. Use ~all (softfail) while you confirm your list is complete, then tighten to -all (fail) once you’re confident every legitimate sender is covered.
The all-qualifier tells receivers what to do with mail from servers not listed in your record. -all (fail) rejects it, ~all (softfail) accepts it but marks it as suspicious, and ?all (neutral) takes no position. Start with ~all while you build your list, then move to -all for the strongest protection.
SPF allows a maximum of 10 DNS lookups when evaluating a record. Each include, a, and mx mechanism costs a lookup, and going over the limit makes SPF fail with a permerror. If you add many providers, watch the warning above and trim your list, or let Hunter manage your sending domain to stay under the limit.
Publish it as a TXT record at your domain root (for example yourdomain.com) in your DNS provider’s settings, the same place you manage your other DNS records. The value is the full record generated above. Only one SPF record is allowed per domain, so merge everything into a single record.
Yes, completely free with no signup and no limits. If you’d rather not manage DNS by hand, you can create a free Hunter account and we help you get email authentication set up for your sending domain.
After you publish the record and DNS propagates, run your domain through the Email Deliverability Checker to confirm SPF, DKIM, and DMARC all pass. It also flags common problems such as too many lookups or a missing all-qualifier.
No. A domain must have exactly one SPF record. If you send from several providers, combine all of their includes and mechanisms into a single v=spf1 record. Publishing two separate SPF records makes SPF fail, so use this generator to build one record that covers every sender.
SPF lists the servers allowed to send email for your domain, DKIM signs your messages so receivers can verify they weren’t tampered with, and DMARC ties the two together with a policy and reporting. All three work together to prove your emails are genuine. Use the DMARC Record Generator to build your DMARC record alongside this one.
Once you save the TXT record, it typically propagates within a few minutes to a few hours, depending on your DNS provider and the record’s TTL. After that, receiving servers start checking your senders against it on every message.
More than 7,000,000 professionals use Hunter to build more connections and grow their business.
