DNSVerdictAll toolsGuidesHow it works

How to create an SPF record (syntax and examples)

Published · Updated

An SPF record is a single TXT record at your domain that starts with v=spf1, lists the servers allowed to send mail for you, and ends with an all term that says what to do with everyone else. If the SPF checker reports “no SPF record”, publish one record like the example below, with the include: values from each service that sends your mail. There must be exactly one v=spf1 record per name (RFC 7208 §4.5); a second one turns every check into permerror.

example.com.  3600  IN  TXT  "v=spf1 include:_spf.sender-one.example include:_spf.sender-two.example ~all"

The include hostnames above are placeholders. Copy the real value from each provider’s own documentation, or use the provider setup check, which shows the include for providers in our database.

Syntax

A record is the version tag followed by space-separated terms. Each term is an optional qualifier plus a mechanism (RFC 7208 §4.6.2 and §5):

TermMeaningCosts a DNS lookup
ip4:203.0.113.0/24, ip6:2001:db8::/32Sending IP or rangeNo
include:_spf.sender.exampleAlso accept whatever that domain’s SPF acceptsYes
a, a:host.exampleThe A/AAAA addresses of the nameYes
mxThe addresses of the domain’s MX hostsYes
exists:Passes if the name resolvesYes
ptrReverse-DNS match; RFC 7208 §5.5 says not to use itYes
allMatches everything; always lastNo

Qualifiers: + pass (the default if omitted), - fail, ~ softfail, ? neutral. So mx means +mx. Mechanisms after all are ignored (§5.1). A redirect= modifier is ignored if the record contains all (§6.1).

Long records: a TXT record can hold several quoted strings of up to 255 characters; receivers join them without adding spaces (§3.3). Most DNS panels do this for you. Keep the whole record small enough to fit in a 512-octet DNS answer (§3.4) when you can.

One record per name

Publish all senders in one record. Do not add a second TXT starting with v=spf1 when you onboard a new service; merge its include into the existing record:

Before: "v=spf1 include:_spf.google.com ~all"
After:  "v=spf1 include:_spf.google.com include:_spf.sender-two.example ~all"

For the provider-specific values, see the full setup guides for Google Workspace, Microsoft 365 and Zoho Mail. Each of those guides covers the MX, DKIM and DMARC records alongside SPF. SPF applies per domain name: a subdomain such as news.example.com needs its own record if it appears in the envelope sender, because the parent record is not inherited.

~all or -all

-all tells receivers that unlisted servers are not authorized (fail); ~all says they are probably not authorized (softfail, RFC 7208 §2.6). Trade-off: with -all, any sender you forgot, such as an invoicing tool or a forwarding setup, can be rejected outright by receivers that act on SPF alone. With ~all, receivers usually still accept and mark the mail. If you use DMARC, the DMARC policy decides what happens to failing mail, and many operators publish ~all and rely on DMARC and DKIM. Start with ~all, read your DMARC reports, and change to -all only when every legitimate sender is listed. Avoid +all, which authorizes the entire internet, and ?all, which asserts nothing.

The 10-lookup limit and void lookups

include, a, mx, ptr, exists and redirect each cost a DNS lookup, and RFC 7208 §4.6.4 requires receivers to return permerror when evaluation needs more than 10. Includes count everything nested inside them. SPF “too many DNS lookups” explains how to count and how to get under the limit.

Separately, §4.6.4 says implementations SHOULD limit “void lookups” to two. A void lookup is a query that returns no records or NXDOMAIN, typically an include: for a provider that you stopped using and whose record was deleted. Exceeding the limit also produces permerror. Remove includes of services you no longer use rather than leaving them in place.

Test the record

  1. Publish the TXT record and wait for the old TTL to expire.
  2. Run your domain through the SPF checker. Confirm there is one record, the lookup count is 10 or fewer, and your sending IPs are authorized.
  3. Send a real message to a mailbox you control and read the Authentication-Results header for spf=pass.

FAQ

Do I need SPF if I use DKIM and DMARC? DMARC passes if either SPF or DKIM passes with alignment, so one can cover for the other. Publishing both is more robust: forwarding commonly breaks SPF, and mailing lists commonly break DKIM.

I only receive mail and never send. What do I publish? v=spf1 -all states that no host may send as this domain. The trade-off is that it is also wrong for the day you start sending, so update it before you do.

Why does my host say the TXT record is too long? A single string is capped at 255 characters. Split it into several quoted strings or let the DNS panel do it; receivers join them (§3.3).

Sources

Tools used

SPF Record CheckerEmail Provider Setup CheckDNS Lookup