An SPF record lists every service allowed to send email from your domain. It is one TXT record at the domain root in the form v=spf1 include:<provider-1> include:<provider-2> ~all. A domain that only sends through Google Workspace, for example, publishes v=spf1 include:_spf.google.com ~all. Use the generator below, start with ~all, and tighten to -all once every legitimate sender is listed.
Sending from Winnr mailboxes? You don't need this generator for those domains. When Winnr hosts a domain's DNS it writes the SPF record for you, and for a domain connected with manual DNS it shows the exact SPF value to copy. A domain can only have one SPF record, so keep cold email on its own domains instead of merging it into your main domain's SPF. See how Winnr's SMTP mailboxes for cold email handle authentication.
SPF Generator
@):v=spf1 ~all
All generation happens in your browser. Nothing is sent to Winnr's servers.
SPF Checker
Lookups go from your browser to Google Public DNS over DNS-over-HTTPS, with Cloudflare as a fallback. Nothing is logged by Winnr.
What Is an SPF Record?
SPF (Sender Policy Framework, defined in RFC 7208) is a DNS TXT record at your domain's root that lists the mail servers authorized to send email on your behalf. When a receiving mail server gets a message from you@yourdomain.com, it looks up the SPF record for yourdomain.com and checks whether the sending server's IP is listed. If it isn't, receivers know the mail is likely spoofed.
SPF is one of three DNS records every cold email domain needs. The trio is SPF + DKIM + DMARC. Since February 2024, Google and Yahoo require all three from bulk senders (more than 5,000 messages a day to their users), and Microsoft has applied similar requirements to high-volume senders to Outlook.com since May 2025. Treat all three as required for every cold email domain.
Common Mistakes
- Publishing two SPF records. A domain must have exactly one SPF record. Multiple records invalidate SPF entirely. Merge everything into a single
v=spf1 ...TXT. - Exceeding the 10-lookup limit. Each
include:,a,mx,exists:, orredirect=counts, and includes nested inside includes count too. The generator above warns you at 8 lookups and errors above 10. If you hit the cap, drop inactive providers or replace includes with the provider'sip4:ranges. - Merging cold email into your main domain's SPF. Send cold email from separate domains so a reputation problem can't touch your company mail. Each sending domain then needs only its own sender in SPF. On Winnr that record is written for you, or shown for you to copy on manually connected domains.
- Using
+all. Never use+all. It means "accept mail from any server claiming to be you", which is the opposite of what SPF is for. - Not testing after DNS propagation. Use the checker above 5-15 minutes after publishing to confirm the record is live and parseable.
How to Publish Your SPF Record
- Copy the generated record from the box above.
- Log in to your DNS host (Cloudflare, Namecheap, GoDaddy, Route 53, Squarespace, and so on).
- Create a new TXT record with host/name
@(or leave blank for the root, depending on the provider). - Paste the generated value. Leave TTL at 3600 or the default.
- Save. Wait 1-15 minutes for propagation, then verify with the checker above.
Provider Quick Reference
Lookup counts include nested includes and were measured in October 2026. Providers change their SPF records, so check your provider's current documentation before you publish.
| Provider | Include mechanism | DNS lookups |
|---|---|---|
| Google Workspace | include:_spf.google.com | 1 |
| Microsoft 365 | include:spf.protection.outlook.com | 1 |
| SendGrid | include:sendgrid.net | 2 |
| Mailgun | include:mailgun.org | 5 |
| Amazon SES | include:amazonses.com | 1 |
| Postmark | include:spf.mtasv.net | 1 |
| Mailchimp | include:servers.mcsv.net | 1 |
| Zoho Mail | include:zohomail.com | 2 |
| HubSpot | include:_spf.hubspotemail.net | 1 |
Next up: Pair SPF with DKIM (cryptographic signature) and DMARC (enforcement policy). All three are required in 2026.
Frequently Asked Questions
What is an SPF record?
SPF (Sender Policy Framework) is a DNS TXT record that lists which servers are allowed to send email on behalf of your domain. Receiving mail servers check SPF to detect spoofed senders. An SPF record looks like v=spf1 include:_spf.google.com ~all.
Do I need SPF for cold email?
Yes. Since February 2024, Gmail and Yahoo require SPF and DKIM from bulk senders and filter or reject unauthenticated mail, and Microsoft applies similar rules to high-volume senders to Outlook.com. Every cold email domain should publish exactly one valid SPF record, plus DKIM and DMARC.
How do I add Google Workspace to my SPF record?
Add include:_spf.google.com. A Google-only record is v=spf1 include:_spf.google.com ~all. If another provider also sends for the domain, add its include to the same record, for example v=spf1 include:_spf.google.com include:sendgrid.net ~all.
How do I add Microsoft 365 to my SPF record?
Add include:spf.protection.outlook.com. A Microsoft-only record is v=spf1 include:spf.protection.outlook.com -all.
What is the difference between ~all and -all?
~all (softfail) tells receivers that a sender not listed is probably not legitimate, without asking them to reject it. -all (hardfail) tells receivers that any sender not listed is unauthorized. Start with ~all until you have confirmed every legitimate sender is listed, then switch to -all.
Can I have more than one SPF record?
No. A domain can only have one SPF record. Two or more v=spf1 records make SPF return a PermError, which receivers treat as a failure. Combine your senders into a single record with multiple include: mechanisms, for example v=spf1 include:_spf.google.com include:sendgrid.net ~all.
What is the 10 DNS lookup limit for SPF?
RFC 7208 caps SPF evaluation at 10 DNS lookups. Each include:, a, mx, exists:, and redirect= counts as one, and includes nested inside includes count too. Go over 10 and SPF returns PermError, which is treated as a fail. If you hit the limit, remove providers you no longer use or replace includes with the provider's ip4: ranges.
Does Winnr set up SPF automatically?
Yes. When Winnr hosts a domain's DNS (domains bought through Winnr, or domains connected by nameservers or a Cloudflare token), it writes the SPF, DKIM, and DMARC records for you. For a domain connected with manual DNS, Winnr shows the exact SPF value to copy. Use that value as shown rather than building one here.
How do I check my SPF record?
Use the SPF Checker on this page. Enter your domain and the tool looks up its TXT records live over DNS-over-HTTPS (Google Public DNS, with Cloudflare as a fallback) and lists each mechanism. From a terminal, run dig TXT example.com +short.
What happens if I don't publish an SPF record?
Receivers treat the domain as unauthenticated for SPF. Gmail requires every sender to pass SPF or DKIM and bulk senders to pass both, so cold email from a domain without SPF is far more likely to be filtered to spam or rejected. Publish SPF before the first send.
Related tools: DKIM Record Generator · DMARC Record Generator · Domain Health Checker · Cold Email Calculator. Related reading: Cold Email DNS Setup Checklist.