SPF is one TXT record at the root of your domain listing the servers allowed to send mail as you. Receivers check it against the server that hands them the message. Getting it right comes down to three decisions: what goes in, how it ends, and staying under the lookup limit.
Build the record
Start with v=spf1. Add one term for each service that sends mail using your domain as the bounce address, then end it. A business on Google Workspace that also sends invoices through a billing tool might end up with:
v=spf1 include:_spf.google.com include:spf.billingtool.example ~all
Each service's include comes from its own "domain authentication" help page. Don't guess them, and don't copy them from another company's record. These are the ones for the main mailbox providers, checked against live DNS on 7 November 2026:
| Mail provider | SPF include |
|---|---|
| Google Workspace | include:_spf.google.com |
| Microsoft 365 | include:spf.protection.outlook.com |
| Zoho Mail | include:zohomail.com. Accounts hosted in Zoho's EU, India or Australia data centres see a regional version in the admin console; use that one. |
| Namecheap Private Email | include:spf.privateemail.com |
| GoDaddy (Professional Email and Microsoft 365 from GoDaddy) | include:secureserver.net |
Servers you run yourself go in as ip4:203.0.113.10 or an ip6: range. Those cost no DNS lookups.
~all or -all
~all (softfail) says "anything not listed probably isn't us". -all (fail) says "anything not listed definitely isn't us". Once DMARC is enforcing, receivers act on the DMARC result rather than the SPF ending, so in practice the gap is small. Use ~all while you're still finding every sender, and switch to -all if you like once the DMARC reports are clean. Never use +all, which authorises the whole internet. ?all says nothing at all.
The two limits
- One record. Two TXT records that start with
v=spf1make SPF fail outright. See merging SPF records. - Ten DNS lookups. Every
include,a,mx,existsandredirectcosts one, and so does every one inside the records you include. Google's include costs 1. Some marketing platforms cost 4 or more. Over 10, SPF returns a permanent error. See the lookup fix.
One thing people trip on: SPF checks the bounce (Return-Path) domain, not the From address people see. Plenty of newsletter and helpdesk tools bounce mail to their own domain, so your SPF record never applies to their mail. For those tools, DKIM is what makes DMARC pass.
Publish it
Add a TXT record with the name @ (some DNS hosts want it left blank) and the record as the value. If an SPF record already exists, edit it. Don't add a second one. Then run the checker below and look at the lookup count.
Questions people ask
Do I need SPF if I have DKIM?
Yes. DMARC passes with either one aligned, but Gmail and Yahoo require both from bulk senders, and many receivers still look at SPF first.
Can I include the same service twice?
It does nothing useful and costs lookups. Remove the duplicate.
Do subdomains need their own SPF record?
Only if they send mail. SPF isn't inherited, so news.yourcompany.com needs its own record if a tool sends from it.
Related guides
- SPF too many DNS lookups: how to get under 10 Which terms count, how to count nested includes, and five ways to get under 10.
- Two SPF records? Merge them into one Why two records fail every message, and how to merge them.
- Moving DMARC from p=none to reject without losing mail The order of steps, how long to wait, and what to look for first.
DNS only shows part of the picture. If mail is still landing in spam with every record right, the deliverability audit looks at the rest: blocklists, reputation, bounces, content and the sending setup.