@NullBounce
Log In
Sign Up Free
🛡️ Free DNS Configuration Builder

Free SPF Record Generator

Build a valid Sender Policy Framework (SPF) record in seconds. Merge multiple sending services, track your 10-lookup budget in real time, and eliminate fatal DNS errors.

Build Your SPF Record

TXT Record Builder

Select your authorized sending services to construct a single merged SPF string.

Presets:

Enter your root apex domain (without subdomains or http).

2. Authorize Sending Services (Includes)
Estimated lookups (min): 1/10
💡
Where are Mailchimp, SendGrid, Postmark, and Amazon SES? Modern email service providers (ESPs) achieve DMARC alignment via DKIM or by using CNAME records on a custom return-path subdomain (e.g., bounce.yourdomain.com). Adding them to your root domain's SPF record is a legacy practice that provides zero DMARC alignment benefit and dangerously wastes your 10-lookup limit.
* Providers may contain internal nested includes. Verify exact live tree in Checker →
3. Domain Server Mechanisms (MX & A)
4. Policy Enforcement Qualifier (~all vs -all)
Generated SPF Record
Lookups (min): 1/10 Type: TXT
Host / Name:
@ (represents root apex: yourdomain.com)
TXT Value:
v=spf1 include:_spf.google.com ~all
Audit domain in Email Authentication Checker →

How to Publish SPF to Your DNS Host

⚠️ Never create multiple SPF records

If you already have a TXT record starting with v=spf1, replace it with the merged record generated above.

  1. Log in to your Cloudflare Dashboard and select your domain.
  2. Go to DNS → Records and check if an existing v=spf1 record exists. (Delete or edit it).
  3. Click Add record. Set Type to TXT.
  4. Set Name to @ (root domain).
  5. Paste the generated string into Content. Set TTL to Auto and click Save.
Published to DNS? Wait 2–5 minutes for propagation, then verify: Run Instant Email Auth Audit →
Technical Guide

Why Basic SPF Generators Break Deliverability

SPF is simple in concept, but strict RFC 7208 limitations cause thousands of legitimate marketing campaigns to land in spam:

Limit 10

The 10 DNS Lookup Trap

RFC 7208 strictly limits SPF evaluation to 10 DNS queries. If your record requires 11 lookups, receiving mail servers abort with a PermError, failing authentication completely.

Causes instant delivery failure
Single TXT

Never Create Multiple Records

Publishing two separate TXT records starting with v=spf1 causes receiving servers to throw a PermError. All providers must be merged into one single record.

Must be unified into 1 string
The ESP Trap

Adding Mailchimp & SendGrid

Legacy tutorials tell you to add include:sendgrid.net to your root domain. Modern ESPs achieve DMARC alignment via DKIM or CNAME return-paths. Adding them to your apex SPF wastes lookups for zero security gain.

Stop wasting your 10-lookup budget
RFC 7208 Breakdown

What Counts Towards the 10 DNS Lookups?

Understanding which mechanisms trigger DNS requests is the key to maintaining a healthy SPF record:

MechanismConsumes Lookup?Explanation
include:domainYes (+1 or more)Resolves the target domain's SPF record, plus any nested includes inside it.
mxYes (+1)Queries DNS for your domain's MX hostnames.
aYes (+1)Queries DNS for your domain's A or AAAA IP address.
redirect=domainYes (+1)Replaces current evaluation with the target domain's record.
ip4:IP / ip4:CIDRNo (0)Literal IP comparison. Does not require any DNS lookup!
ip6:IP / ip6:CIDRNo (0)Literal IPv6 comparison. Zero lookups consumed.
all (~all, -all)No (0)Terminal policy modifier. Zero lookups consumed.
The Deliverability Equation

SPF Protects Your Sending Server. NullBounce Protects Your Bounce Rate.

Publishing a valid SPF record confirms to Google and Microsoft that your outgoing mail server is authorized. However, SPF cannot protect you if you send to dead or invalid email addresses.

If your cold outreach or newsletter list has a bounce rate over 2%, spam filters will downgrade your sender reputation even with 100% valid SPF and DMARC records.

Clean your prospect databases before launching campaigns. Use NullBounce to eliminate hard bounces, catch-alls, and disposable mailboxes from as low as $0.0003 per verification.

Includes 100 free verification credits upon sign-up.Verify First 100 Emails Free →

SPF Generator: Frequently Asked Questions

Clear answers about SPF record syntax, lookups, and DNS publishing.

Where do I publish my generated SPF record?

In your domain's DNS manager (Cloudflare, GoDaddy, Namecheap, Route 53). Add a TXT record at the root host @ (or your naked domain). Never publish it as a deprecated type "SPF" record.

What happens if I publish two SPF records?

Receiving mail transfer agents (MTAs) will immediately reject your emails with an SPF PermError. RFC 7208 §3.2 strictly mandates that a domain must publish at most one SPF TXT record. If you have two sending services, you must merge them into one record using multiple include: mechanisms.

What is the difference between ~all and -all?

~all (SoftFail) accepts emails from unlisted IPs but tags them as untrusted; it is the industry recommendation when running DMARC. -all (HardFail) explicitly asks receiving servers to reject unauthorized emails immediately.

How do I verify that my new SPF record works?

Wait 2–5 minutes for DNS propagation, then test your domain in our free Email Authentication Checker. It will audit your published record, count real DNS lookups, and verify Google/Yahoo compliance.

Authenticate Your Domain. Eliminate Hard Bounces.

Publish your merged SPF record today, then clean your prospect databases with NullBounce. Start testing with 100 free verification credits.

Verify 100 Contacts Free →