Discuss your project

TOOLBOX · GENERATOR

Create anSPF Record.

Select services and your own servers, then copy the finished SPF record, with DNS lookups counted against the limit of 10. Runs only in your browser.

Examples

An example fills the form with suitable values. Your domain is kept; if it is empty, example.at is used.

Domain

The domain in the sender address. The record is a TXT record at the domain itself (name @ or empty).

Does the Domain Send Email?
Services

Select every service that sends email using your domain in the sender address. Values come from the vendor’s instructions.

The domain from the service’s SPF instructions (newsletter, CRM, accounting), one per line. The generator adds include:.

Select at least one service or server that sends email for the domain. If the domain never sends email, select that option above.

Your Own Servers

Specify servers with a fixed address as ip4 or ip6 where possible: this requires no DNS lookup.

Final Mechanism

What applies to every server not listed in the record?

Final Mechanism

Your SPF Record

Enter your domain above or select an example. The record is generated here as you type.

Browser only: this tool does not send your input to TOMORIS or third parties and does not store it.

STEP BY STEP

One Record.
Every Sender.

SPF is a TXT record in your domain’s DNS. It lists servers allowed to send email with your domain as the technical sender. Together with DMARC, it also protects the address recipients see.

  1. 01

    List Senders

    Mailbox service, newsletter, CRM, accounting, online shop, scanner and printer: every service sending with your domain belongs in the record or sends from its own subdomain.

  2. 02

    Generate the Record

    Select services, enter servers with fixed addresses as ip4 or ip6, and watch the DNS lookup count.

  3. 03

    Replace the Existing Record

    Each domain has exactly one SPF record. Two records produce an error (RFC 7208, Section 4.5).

  4. 04

    Check

    After publishing, the Email Security Check (German) resolves the entire include chain and counts all lookups.

  5. 05

    Add DMARC

    DMARC tells receivers what to do with forged emails. Build the record with the DMARC Generator.

COMMON MISTAKES

Where SPF
Often Goes Wrong.

  • Two SPF Records

    Adding a second record for a new service makes both ineffective (permerror). Add the new service to the existing record.

  • More Than 10 Lookups

    Every include costs at least one lookup, often several. Above 10, receivers treat SPF as an error (RFC 7208, Section 4.6.4).

  • +all or ?all

    +all authorizes every server on the internet to send; ?all makes no statement. BSI TR-03182 requires at least softfail for unauthorized servers.

  • Typos and Spaces

    “include: spf.protection.outlook.com” with a space after the colon is invalid. The generator writes each mechanism in the correct form.

  • ptr

    The ptr mechanism should no longer be published: it is slow and unreliable (RFC 7208, Section 5.5). The generator does not offer it.

  • SPF Without DMARC

    SPF checks only the technical sender address (Return-Path), rather than the address shown in the mailbox. DMARC is needed to counter forged senders.

SOURCES AND NEXT STEPS

Values from
Vendor Instructions.

include values come from each vendor’s documentation, checked on October 25, 2026. If a vendor changes its value, follow its instructions.

Further sources: Brevo, Mailchimp, SendGrid, Amazon SES.

QUESTIONS

Good to Know.

Is my input transmitted to TOMORIS?

No. The generator runs entirely in your browser and does not query DNS. The domain, addresses and services are neither sent nor stored.

Why at most 10 DNS lookups?

RFC 7208 limits mechanisms and modifiers that trigger DNS lookups at the receiver (include, a, mx, ptr, exists and redirect) to 10 in total, including referenced records (Section 4.6.4). Exceeding this produces an error (permerror) and SPF does not protect the domain. ip4 and ip6 do not count.

-all or ~all?

-all declares every unlisted server unauthorized (fail); ~all considers them only probably unauthorized (softfail, RFC 7208, Section 2.6). BSI TR-03182 permits both, but neither ?all nor +all. Start with ~all while some senders are still unknown, then switch to -all.

Does the generator resolve include records?

No. It counts lookups in your own record. Each included record adds its own lookups, which also count. The Email Security Check shows the complete count once the record is published.

Does every newsletter service need an include?

No. According to their instructions, Mailchimp and Brevo require DKIM records (and DMARC) for normal sending, rather than an SPF record. SendGrid and Amazon SES set SPF on a separate subdomain for the return address. Follow your service’s instructions and enter only what they specify.

TOOLBOX

More
Tools.

YOUR NEXT STEP

You Have the Result.
What Comes Next?

We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.

Discuss the Result