SPF (Sender Policy Framework) is a DNS record that tells the world which servers are allowed to send email on behalf of your domain. Without SPF, receiving servers have no way to verify your emails are legitimate.
What is an SPF Record?
An SPF record is a TXT record in your domain's DNS that lists all the servers and services authorized to send email from your domain. Here's a basic example:
v=spf1 include:_spf.google.com ~all
This record says:
v=spf1— This is an SPF version 1 recordinclude:_spf.google.com— Google Workspace servers are authorized~all— Softfail anything not listed (mark as suspicious)
SPF Syntax Explained
| Mechanism | Example | Meaning |
|---|---|---|
| include: | include:_spf.google.com | Include another domain's SPF |
| ip4: | ip4:192.0.2.0/24 | Authorize an IPv4 address/range |
| ip6: | ip6:2001:db8::/32 | Authorize an IPv6 address/range |
| a | a:mail.example.com | Authorize the A record's IP |
| mx | mx | Authorize all MX servers |
Qualifiers (the ending)
-allHard FailReject emails from unlisted servers. Strictest.
~allSoft FailMark as suspicious but accept. Most common.
?allNeutralNo policy. Not recommended.
+allPass AllAllow anyone. Never use this!
Common Provider Includes
Here are the SPF includes for popular email services. Add these to your SPF record if you use them:
| Provider | SPF Include |
|---|---|
| Google Workspace | include:_spf.google.com |
| Microsoft 365 | include:spf.protection.outlook.com |
| SendGrid | include:sendgrid.net |
| Mailchimp | include:servers.mcsv.net |
| Amazon SES | include:amazonses.com |
| Zoho | include:zoho.com |
| Mailgun | include:mailgun.org |
| Postmark | include:spf.mtasv.net |
Common SPF Mistakes
SPF allows only 10 DNS lookups total. Each include:, a, mx, and redirect counts. If you hit this limit, SPF fails entirely.
Fix: Flatten includes into IP addresses, or use an SPF flattening service.
You can only have ONE SPF record per domain. Two records = both fail.
Fix: Combine all includes into a single TXT record.
This allows anyone to send email as your domain. Never use +all.
If you use Mailchimp, SendGrid, etc., you need their include in your SPF.
Example SPF Records
v=spf1 include:_spf.google.com ~all
v=spf1 include:spf.protection.outlook.com include:sendgrid.net ~all
v=spf1 include:_spf.google.com include:servers.mcsv.net include:amazonses.com ~all