How to use it
Tick every service that sends email using your domain, add your own server IPs, and publish the value as a TXT record at the domain apex. The include values here are the ones each provider documents; if a provider is missing, paste its include: value in the "other includes" box. After publishing, run the SPF checker to confirm the lookup count.
SPF record generator: questions
What is the difference between -all and ~all in SPF?+
-all (fail) states that servers not listed may not send for the domain; ~all (softfail) says they probably may not, and receivers usually accept such mail but treat it as suspicious. Under DMARC both count as SPF not passing. Start with ~all while you confirm every sender, then switch to -all once DMARC reports show all legitimate mail is covered.
How do I add a new email service to my SPF record?+
Add the service's include: term to your existing record instead of publishing a second one, and keep -all or ~all at the end, for example v=spf1 include:_spf.google.com include:mail.zendesk.com -all. Each include uses at least one of the 10 allowed DNS lookups, often more through nested includes, so check the total after publishing. Some services want no include at the root at all: Amazon SES, SendGrid and Postmark put SPF on a return-path subdomain they set up, and Mailchimp relies on DKIM.
What SPF record should a domain that sends no email have?+
v=spf1 -all, published as a TXT record at the domain. It states that no server may send mail for the domain, so receivers can fail any message that claims to come from it. Pair it with a DMARC record at p=reject, and with a null MX record (0 .) if the domain receives no mail either.
Where do I publish an SPF record?+
As a TXT record on the domain itself, entered as @ or left blank as the host in most DNS panels. SPF is checked against the exact domain in the envelope sender, so a subdomain used as a Return-Path needs its own record. Do not use the old SPF record type: RFC 7208 §3.1 discontinued it in favour of TXT.
How long can an SPF record be?+
255 characters per string, but one TXT record can hold several strings. A longer record is split into quoted strings that receivers join without spaces (RFC 7208 §3.3), and RFC 7208 §3.4 asks that the whole DNS answer stay within 512 bytes. In practice the limit of 10 DNS lookups usually becomes the problem first.
Does the order of terms in an SPF record matter?+
Yes, in places. Receivers evaluate terms left to right and stop at the first match, so all must come last: terms after it are ignored (RFC 7208 §5.1), and a redirect= modifier is ignored whenever all is present. Otherwise order mostly affects how many lookups a receiver makes before it finds a match.