How to Create an SPF Record: Generator Guide for Common Email Providers

Before writing your SPF record, identify all services that send email on behalf of your domain:

1. Your primary email provider (Google Workspace, Microsoft 365, Zoho) 2. Any marketing email platforms (Mailchimp, Klaviyo, HubSpot, Constant Contact) 3. Transactional email services (SendGrid, Postmark, Mailgun, AWS SES) 4. CRM systems that send email (Salesforce, HubSpot) 5. Your own servers or applications that generate email 6. Any other third-party services (helpdesks like Zendesk, scheduling tools, etc.)

Missing a service means email from that service will fail SPF.

Google Workspace: include:_spf.google.com Microsoft 365: include:spf.protection.outlook.com SendGrid: include:sendgrid.net Mailchimp (Mandrill): include:spf.mandrillapp.com Mailgun: include:mailgun.org AWS SES: include:amazonses.com (or region-specific) Zendesk: include:mail.zendesk.com Salesforce: include:_spf.salesforce.com HubSpot: include:_spf.hubspot.com Zoho Mail: include:zoho.com Constant Contact: include:spf.constantcontact.com FastMail: include:spf.messagingengine.com

# Google Workspace only
v=spf1 include:_spf.google.com -all

# Microsoft 365 only
v=spf1 include:spf.protection.outlook.com -all

# SendGrid only
v=spf1 include:sendgrid.net -all

# Google Workspace + SendGrid + dedicated IP
v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.5 -all

# Multi-service: Google + Mailchimp + HubSpot
v=spf1 include:_spf.google.com include:spf.mandrillapp.com include:_spf.hubspot.com -all

Start with v=spf1 and add your includes:

v=spf1 include:_spf.google.com include:sendgrid.net -all

If you have specific IP addresses (your own servers), add them with ip4:

v=spf1 ip4:203.0.113.5 include:_spf.google.com include:sendgrid.net -all

End with -all (hard fail — reject unauthorized senders) or ~all (soft fail — mark with suspicion). Start with ~all while you're still discovering all your sending sources; switch to -all once you're confident the record is complete.

Add a TXT record to your domain's DNS: - Name/Host: @ (or leave blank, meaning the root domain) - Type: TXT - Value: v=spf1 include:... -all - TTL: 3600 (1 hour) or your DNS provider's default

Important: Only one SPF record is allowed per domain. If you already have one, edit it rather than adding a new TXT record.

After publishing, wait 1-48 hours for DNS propagation, then use an SPF checker to verify the record resolves correctly and count your DNS lookups.