Skip to content

What is an SPF record?

By Ash, Founder, HosteazePublished 1 min read

The short answer

An SPF record is a TXT record on your domain that lists which mail servers are allowed to send email using your domain name. Receiving servers check it to spot forgeries. Each domain can have only one SPF record, and it must stay within 10 DNS lookups or it stops working.

Clipboard holding a printed checklist beside a laptop, like the list of approved senders an SPF record keeps
Credit: viarami via Pixabay

SPF stands for Sender Policy Framework. Think of it as the guest list for your domain's email: when a message arrives claiming to be from you, the receiving server checks whether the server that sent it is on the list. It works alongside DKIM and DMARC.

What does an SPF record look like?

v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all
PartMeaning
v=spf1Identifies the record as SPF. Must come first.
include:Adds another service's list of servers, such as Google Workspace or Microsoft 365.
ip4: / ip6:Allows a specific IP address or range, for example a server you run yourself.
a / mxAllows the servers your domain's A or MX records point to.
~allAnything not listed is a "soft fail": treat it as suspicious.
-allAnything not listed fails outright.

Real records usually only need one or two include: terms. The example above covers a business that uses both Google and Microsoft, which is rarer than you'd think.

What goes wrong with SPF?

Three mistakes cause most SPF problems:

  1. Two SPF records. Adding a new service by creating a second v=spf1 record breaks SPF completely. Edit the one you have instead.
  2. Too many lookups. Every include:, a, mx, ptr, exists and redirect costs a DNS lookup, and the limit is 10. Go over it and SPF returns an error. See how to fix "too many DNS lookups".
  3. Forgotten senders. Your website's contact form or invoicing software sends as you too. If it isn't listed, its emails fail.

Is SPF enough on its own?

No. SPF checks the hidden "envelope" sender, not the From address people see, and it breaks when email is forwarded. That's why it's paired with DKIM and DMARC. For the full setup in the right order, see how to set up SPF, DKIM and DMARC.

Frequently asked questions

Where do I add an SPF record?

In the DNS settings for your domain, wherever your nameservers point. It's a TXT record on the root of the domain, usually entered with the host set to @.

Can I have two SPF records?

No. Two records starting with v=spf1 make SPF fail for every email. Combine every service into one record with several include terms.

Should my SPF record end in ~all or -all?

Either works once DMARC is in place. ~all marks unlisted senders as suspicious and -all says they fail outright. Many providers suggest ~all while you are still finding every service that sends as you.

Sources

  1. RFC 7208, Sender Policy Framework (SPF)
  2. Google Workspace, Set up SPF
  3. Microsoft, Set up SPF to identify valid email sources

Keep reading

Traffic light showing a red stop signal under a blue bicycle signalQuestionDMARC p=none vs quarantine vs reject, which should I use?p=none tells receivers to deliver failing email as normal and just send you reports. p=quarantine sends failing email to spam. p=reject blocks it completely. Start at none, read the reports until every service you use passes, then move to quarantine and finally reject. Skipping straight to reject can block your own invoices.Email and domains · 12 October 2026Magnifying glass and pen resting on printed spreadsheets, ready to check the detailsQuestionHow do I check if my domain has DMARC?Look up the TXT record at _dmarc.yourdomain.com. The quickest way is the free Google Admin Toolbox Dig tool. Enter _dmarc followed by your domain, choose TXT, and look for a value starting v=DMARC1. If nothing comes back, your domain has no DMARC record and you should add one.Email and domains · 12 October 2026Open red mailbox with a stream of envelopes flying away from it, like email going astrayQuestionWhy are my emails going to spam?The most common reason is missing or broken email authentication. If your domain has no SPF, DKIM or DMARC records, Gmail and Outlook can't prove the email is really from you. After that come a poor sender reputation, a shared server with a bad history, and messages that look like marketing. Check authentication first.Email and domains · 12 October 2026Hands typing on a keyboard as email envelopes fly outTutorialHow to set up SPF, DKIM and DMARC for your business emailAdd three DNS records in this order. First an SPF record listing who can send email for your domain, then a DKIM record your email provider generates, then, about 48 hours later, a DMARC record starting at p=none. Watch the DMARC reports for a few weeks before tightening the policy to quarantine.Email and domains · 11 October 2026

Want email on your own domain?

Hosteaze hosting plans let you set up mailboxes on your own domain. See what each plan includes.

See hosting plans