DNS Record Generator

Email authentication records are unforgiving. An SPF record with one wrong mechanism can send your legitimate mail to spam folders, or worse, publish a policy so permissive that anyone can forge your domain. Because the syntax is compact and unfamiliar, mistakes are common and their effects are delayed by DNS caching.

This generator builds correctly formatted records from the details you provide, so the syntax is right even if you write one of these once a year. SPF declares which servers are permitted to send mail for your domain and ends with a policy for everything else, where -all is a hard fail and ~all a soft fail.

Two rules save most people from trouble. A domain may publish only one SPF record, so if you use several mail providers you must combine them into a single record rather than adding a second one. And keep the number of DNS lookups the record triggers below ten, because exceeding that limit causes the whole check to fail. Publish, then verify with a mail authentication test before assuming it works.

How to use the DNS Record Generator

1. Enter your domain name.
2. List the servers and providers permitted to send mail on your behalf.
3. Choose the policy for unlisted senders, typically a soft or hard fail.
4. Copy the generated record into a TXT record at your DNS provider.
5. Wait for propagation, then verify with an authentication checker before tightening the policy.

Examples

• A business adds a marketing email platform to an existing SPF record without breaking transactional mail.
• A domain owner publishes a first SPF record after messages start landing in spam.
• An administrator moves from a soft fail to a hard fail policy once all legitimate senders are confirmed.

Frequently asked questions

Can I have more than one SPF record?

No. A domain must publish exactly one. Multiple records cause a permanent error, so merge all senders into a single record.

What is the difference between -all and ~all?

A hard fail asks receivers to reject unauthorised mail; a soft fail asks them to accept but mark it. Start with a soft fail while verifying your senders.

How long do changes take to apply?

DNS changes propagate according to the record TTL, commonly from a few minutes to several hours.

Is SPF enough on its own?

No. Pair it with DKIM signing and a DMARC policy for meaningful protection against domain spoofing.

SwiftMultiTool — free online tools for everyone. Home · Blog · About · FAQ · Contact