SPF DNS generator

THE PRACTICAL GUIDE · NORMANDIN SYSTEMS

Get more from SPF DNS generator

SPF DNS Generator assembles an SPF TXT value from authorized domains, IPv4 addresses, IPv6 addresses, include domains, selected mechanisms, and a terminal policy. Its output is the record value, beginning with v=spf1; the workspace does not generate or publish a DNS owner name. SPF evaluates authorized sending sources for the envelope-sender domain, not simply the visible From address in an email client. Build the value from a verified inventory of legitimate senders and then publish it at the correct domain through your DNS management system. A generated string is a draft to review, and it has no effect on mail handling until it is installed and evaluated by receiving systems.

Guide updated October 13, 2026

How to use this tool

1. Add verified addresses to Allowed IPv4s or Allowed IPv6s. Use Allowed domains for a:domain mechanisms and Include domains for include:domain mechanisms; these are different SPF operations.
2. Review optional mechanisms and choose the terminal policy deliberately. To reproduce the example, enter 192.0.2.10 under Allowed IPv4s, leave optional mechanisms clear, and select Fail all.
3. Copy the Generated SPF record value. Decide the DNS owner name separately, check the existing SPF policy there, and combine authorized sources rather than creating a second SPF record.
4. After publishing the reviewed TXT value, check the authoritative DNS response and inspect real message authentication results from the intended senders.

SEE IT IN PRACTICE

A worked example

Allowed IPv4s: 192.0.2.10
Optional mechanisms: none
Policy: Fail all

v=spf1 ip4:192.0.2.10 -all

This demonstration authorizes one documentation-only IPv4 address and declares a fail result for other sources. Replace it with a verified sender configuration before publication. The DNS owner and TXT record type must be supplied in the DNS system; they are not included in this output string.

Inventory senders before changing policy

A domain can send through ordinary mailboxes, marketing tools, support systems, website notifications, and other infrastructure. Tightening an incomplete SPF policy can affect legitimate messages from a source that was forgotten. Record the envelope-sender domain and the provider's documented authorization mechanism for each source. SPF, DKIM, and DMARC have different roles: passing SPF alone does not guarantee DMARC alignment with the visible From domain. Review them together without treating one generated record as the whole email-authentication configuration.

Review syntax and observed results separately

This generator joins selected values into text and is not a complete policy evaluator. Optional mechanisms can need arguments, includes can introduce additional DNS work, and the policy must fit the domain where it is published. Check the exact authoritative TXT answer after saving it, then inspect actual messages from every legitimate sending path. Cached responses can temporarily differ from the authoritative value. Preserve the previous policy and the reasoning behind the change so an unexpected result can be investigated without guessing which source was intended to be authorized.

When this tool is useful

• Draft a simple sender-authorization TXT value
• Compare a:domain and include:domain mechanisms
• Document a reviewed inventory of outbound mail sources

Tips for a better result

• Do not publish multiple separate v=spf1 policies at the same owner name. Review and combine legitimate sources into one coherent policy.
• Do not publish bare exists or redirect tokens from the optional controls. Those SPF constructs require additional domain syntax that the standalone checkbox does not supply.
• Count DNS-lookup-producing mechanisms across the effective policy, including nested includes, and verify the complete result with appropriate SPF validation before tightening enforcement.

Frequently asked questions