Free tool · Budget-aware
Build your SPF record
without breaking it
Tick the services that send for you, get the exact TXT record — with the 10-lookup budget counted as you compose, not after you've published.
Publish this DNS record
Host / Name
@ (most DNS providers accept “@” for the root)
Value (TXT)
v=spf1 include:_spf.google.com ~all
One SPF record per domain, ever. If a TXT starting with v=spf1 already exists, merge this into it — publishing a second one breaks both.
Estimated lookup budget
≈4 / 10Comfortable. Estimates are based on each provider's current nested includes — verify the real count once the record is live:
Count the real lookups live →Questions, answered honestly
I already have an SPF record. Can I just add this one too?
No — that's the most common SPF mistake there is. Two records starting with v=spf1 is a permanent error; receivers throw both away. Take the include from this generator and merge it into your existing record instead, keeping a single v=spf1 at the start and a single all at the end.
Why do the providers show different lookup costs?
Because includes nest. Google's include pulls in three more includes of its own (≈4 lookups total); SendGrid's resolves to plain IP blocks (1). The generator sums approximate current costs so you can see the budget while composing — and links to the live SPF checker for the exact count once published.
Should I end with ~all or -all?
~all (softfail) while you're still discovering what sends for your domain — it marks failures as suspicious without bouncing them. -all once your DMARC reports have run clean for a few weeks. Never +all (allows everyone) and never ?all (says nothing).
My provider isn't in the list. What do I add?
Search '[provider name] SPF record' in their docs — every sender publishes its include. Add it to your record manually, or paste their sending IPs into the IP field here (raw IPs cost zero lookups, which is why providers with stable IPs are budget-friendly).
Does SPF alone stop spoofing?
No. SPF only checks the invisible envelope sender, not the From address people see — spoofers just use their own envelope. Spoofing protection comes from DMARC, which forces SPF (or DKIM) to align with the visible From domain. Generate your record here, then set up DMARC next.
Generate once. Monitored forever.
Norbelys checks SPF, DKIM and DMARC on every domain you connect and keeps watching them after — record drift gets flagged before it becomes a deliverability incident.
Start sendingFrom $29/mo · Cancel anytime