Generate an SPF record for your domain
Tick your mail providers, add IPs or other senders, and copy one valid record with its lookup count against the limit of 10.
- Google and Microsoft presets
- Lookup counter
- No email required
Your SPF record (TXT, host @)
v=spf1 include:_spf.google.com ~all
- 1 direct DNS lookup of the 10 allowed. Each include can add nested lookups of its own.
The short answer
- An SPF record is one TXT record at your domain's root that lists every server allowed to send mail as that domain.
- Each domain gets exactly one SPF record. Two records make SPF fail with permerror.
- SPF evaluation allows at most 10 DNS lookups; include, a, mx, exists and redirect each count, and ip4 and ip6 don't.
- Google Workspace alone needs v=spf1 include:_spf.google.com ~all, and Microsoft 365 alone needs v=spf1 include:spf.protection.outlook.com -all.
How the generator builds the record
The record is assembled in a fixed order, left to right, because receivers stop at the first match. IP entries come first since they cost no lookups:
- v=spf1, always first.
- Each IPv4 entry as ip4: and each IPv6 entry as ip6:.
- a and mx if you ticked them.
- One include: per provider or extra sender, with duplicates removed.
- Your all rule last: ~all, -all or ?all.
Direct lookups = includes + a + mx. The counter shows that number against the limit of 10 in RFC 7208. Nested includes inside a provider's own record add more lookups, so leave room.
Provider values the presets use
| Provider | Include value | Record when it's the only sender |
|---|---|---|
| Google Workspace | include:_spf.google.com | v=spf1 include:_spf.google.com ~all |
| Microsoft 365 | include:spf.protection.outlook.com | v=spf1 include:spf.protection.outlook.com -all |
| Parked domain, no mail | none | v=spf1 -all |
Values checked on Google Workspace's SPF setup guide (knowledge.workspace.google.com) and Microsoft Learn's SPF configuration page (updated July 2026), September 2026.
Three setups and the record each one produces
Google Workspace only, soft fail. Tick Google and keep ~all. You get v=spf1 include:_spf.google.com ~all, with 1 direct lookup.
Microsoft 365 plus one office server. Tick Microsoft 365, enter 203.0.113.10 and pick -all. You get v=spf1 ip4:203.0.113.10 include:spf.protection.outlook.com -all. The IP costs no lookup, so the count stays at 1.
Google plus your own servers and a second sender. Tick Google, a and mx, and add mailer.example.net. You get v=spf1 a mx include:_spf.google.com include:mailer.example.net ~all, which uses 4 direct lookups.
One record per sending domain, including the cold email ones
Questions
- How do I create an SPF record?
- List every service that sends mail as your domain, then publish one TXT record at the root that starts with v=spf1, names each sender, and ends with an all rule. The generator above assembles that line for you.
- What is the SPF record for Google Workspace?
- Google's setup guide gives v=spf1 include:_spf.google.com ~all when Google Workspace is the only sender. Add other senders before the ~all if more services send as your domain.
- Can a domain have two SPF records?
- No. Two SPF records make receivers return permerror, and SPF fails for every message. Merge all senders into one record instead.
- Should I use ~all or -all?
- Microsoft recommends -all once DKIM and DMARC are in place, and Google's guide uses ~all. Start on ~all while you confirm every sender is listed, then tighten.
Authenticated domains, then a sender that respects them
SalesCrew runs cadences on your own mailbox pool with daily caps, cooldowns and suppression checked at send.