SPF record generator: how do you build a v=spf1 TXT record?

Fill in your mail senders’ IPs, include domains and the other mechanisms below and this tool assembles the exact v=spf1 TXT record string as you type, entirely in your browser — nothing you enter is sent to AdminKit or anywhere else. Once you are happy with the result, publish it as a TXT record at the root of your own domain, then confirm it took effect with AdminKit’s live SPF check, which queries DNS for real and reports back what it actually found.

What does an SPF record actually authorize?

An SPF record, published as defined in RFC 7208, lists the mail servers allowed to send on behalf of a domain, so a receiving mail server can reject messages forged to look like they came from it. Microsoft Learn’s SPF setup guide walks through the same idea in the context of a specific mail platform — the mechanisms below are what any SPF record is built from, regardless of provider.

The mechanisms this tool builds

• ip4 / ip6 — authorize specific sending IP addresses or CIDR ranges directly. These cost no DNS lookup to evaluate.
• a / mx — authorize a domain’s own A/AAAA records or MX hosts, either this domain’s or another’s.
• ptr — authorizes a domain based on reverse DNS. RFC 7208 §5.5 discourages it (see the FAQ below); this tool still builds it if asked, with a warning.
• include — pulls in another domain’s SPF record wholesale, the usual way third-party mail-sending services (marketing platforms, helpdesks, CRMs) are authorized.
• exists — a rarely-needed mechanism that matches if a DNS A-record lookup for the given domain returns any result at all.
• redirect — points evaluation at another domain’s record entirely, instead of ending the record in all.
• all — the trailing qualifier (-all/~all/?all/+all) that decides what happens to mail matching nothing else.

Limits

• This tool only builds the record text. It never queries DNS and never publishes anything — you still have to add the record to your own DNS and confirm it with a live check.
• It validates the values you enter (address and domain syntax, qualifier keywords) and counts the DNS-lookup-causing terms it can see, but it cannot see what any include or redirect domain itself resolves to once published — for that fully-resolved count, use AdminKit’s live SPF check.

For a plain-language walkthrough of lookup limits and the all qualifier, see AdminKit’s live SPF check or the offline SPF validator for checking a record’s syntax before publishing it. SPF, DKIM and DMARC explained covers how SPF fits together with the other two records, and once your record is live, AdminKit’s DKIM check and DMARC check confirm the records SPF works alongside.