SPF record step by step

SPF (Sender Policy Framework) is a list of servers allowed to send e-mail for your domain. When delivering a message, the receiving server reads your domain's SPF and checks whether the message came from an allowed place. Correct SPF is the foundation – without it DMARC does not work either.

Step 1: list all your senders

The most common SPF mistake is not the syntax but a forgotten sender. Go through everything that sends e-mail with your domain's address:

• the mail server or service (own server, Microsoft 365, Google Workspace, hosting),
• the website – contact forms, orders, e-shop,
• newsletter and marketing tools,
• CRM, helpdesk, invoicing and accounting systems,
• network devices – scan-to-e-mail printers and scanners, monitoring systems.

Step 2: build the record

SPF is a single TXT record on the domain. It starts with v=spf1, followed by permissions and a rule for everyone else at the end:

company.com.  TXT  "v=spf1 mx ip4:192.0.2.10 include:spf.protection.outlook.com -all"

Mechanism	Meaning
ip4:, ip6:	a specific address or range (e.g. ip4:192.0.2.0/24)
a	the addresses the domain points to (e.g. the web server)
mx	the servers from the domain's MX records
include:	takes over another domain's SPF – used by service providers
redirect=	takes the whole SPF from another domain (for several domains with the same senders)
all	all other servers – always at the end

Common include examples: Microsoft 365 include:spf.protection.outlook.com, Google Workspace include:_spf.google.com. For other services see their documentation.

Step 3: choose the rule for everyone else

• -all – reject other servers (the recommended target),
• ~all – only mark them (softfail); fine for a transition period until you are sure nobody is missing,
• ?all – no opinion (neutral); practically no protection,
• +all – allow everyone; never use it.

Rules that are often broken

• Only one SPF record. When adding a new service, edit the existing record. Two v=spf1 records are an error and SPF stops working entirely.
• At most 10 DNS lookups. include, a, mx, exists and redirect count towards the limit – including those inside nested includes. ip4 and ip6 do not count. Above the limit receivers treat SPF as invalid.
• Do not use ptr – it is slow, unreliable and discouraged by the standard.
• Split a long record into several quoted strings within one record (each string max. 255 characters) – do not create a second record.

If you are close to the 10-lookup limit, replace the include of services with fixed addresses by their ip4/ip6 directly. Do not do this for large providers (Microsoft, Google) – their addresses change.

Domains you do not send from

For domains used only for a website or kept in reserve, publish SPF that allows nobody, plus DMARC with reject:

reserve.com.         TXT  "v=spf1 -all"
_dmarc.reserve.com.  TXT  "v=DMARC1; p=reject"

What SPF cannot do

SPF checks the sender address in the message envelope (Return-Path), not the address in the From field that people see. So on its own it does not reveal a forgery – that is what DMARC is for, comparing both addresses. SPF also fails when messages are forwarded; DKIM handles that.

How to verify

After changing DNS (usually effective within an hour, depending on the record's TTL), run our domain test. It shows whether you have one record, how it ends and how many DNS lookups it contains.