SPF record
Learn what an SPF record is, how it prevents email spoofing by authorizing sending mail servers, how to read and write SPF syntax, common setups for Google and Microsoft 365, and how to troubleshoot failures.
What Is an SPF Record?
TL;DR
An SPF record (Sender Policy Framework) is a DNS TXT record that lists which mail servers are authorized to send email on behalf of your domain.
Receiving mail servers check SPF to decide if an incoming email claiming to be from you@example.com actually came from a server you've approved.
Without SPF, anyone can forge your domain in the From header and send spam or phishing email.
How SPF Works
- You publish a TXT record at your domain (e.g.,
example.com) listing your authorized senders. - Someone sends an email claiming to be from
user@example.com. - The receiving mail server looks up
example.com TXTand finds your SPF record. - It checks whether the sending server's IP is in your authorized list.
- Based on the result, it passes, softfails, or rejects the message.
SPF checks the envelope sender (the
MAIL FROMaddress used during SMTP), not the visibleFrom:header. This is why SPF alone doesn't prevent display-name spoofing — that's what DMARC adds.
SPF Record Format
SPF records are TXT records that always start with v=spf1:
example.com. TXT "v=spf1 include:_spf.google.com ~all"Mechanisms
| Mechanism | Meaning |
|---|---|
ip4:1.2.3.4 | Authorize a specific IPv4 address |
ip4:1.2.3.0/24 | Authorize an IPv4 CIDR range |
ip6:2001:db8::/32 | Authorize an IPv6 range |
include:spf.example.com | Merge in another domain's SPF record |
a | Authorize the domain's A/AAAA records |
mx | Authorize the domain's MX servers |
exists:%{i}._spf.example.com | Macro-based conditional lookup |
all | Match everything (used at the end) |
Qualifiers
Each mechanism can have a qualifier prefix:
| Qualifier | Name | Effect |
|---|---|---|
+ (default) | Pass | Authorized — email is legitimate |
- | Fail (hard) | Not authorized — reject the email |
~ | Softfail | Not authorized — accept but mark as suspicious |
? | Neutral | No policy stated |
The all mechanism at the end is the catch-all for IPs not matched by earlier rules:
-all— reject everything else (strict, recommended once you're confident)~all— softfail everything else (safe starting point)?all— neutral (not recommended, no protection)
Common SPF Records
Google Workspace
example.com. TXT "v=spf1 include:_spf.google.com ~all"Microsoft 365
example.com. TXT "v=spf1 include:spf.protection.outlook.com ~all"Multiple providers (e.g., Microsoft 365 + Mailchimp)
example.com. TXT "v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net ~all"Custom mail server + Google
example.com. TXT "v=spf1 ip4:203.0.113.10 include:_spf.google.com ~all"Strict — only your own IP, reject everything else
example.com. TXT "v=spf1 ip4:203.0.113.10 -all"How to Look Up an SPF Record
dig example.com TXTnslookup -type=TXT example.comLook for the line starting with v=spf1 in the output.
SPF Lookup Limit
SPF has a hard limit of 10 DNS lookups during evaluation. Each include:, a, and mx mechanism counts as one lookup. Nested includes count too.
Exceeding 10 lookups causes a PermError, which most receivers treat as a failure. Common causes:
- Too many
include:statements chaining to other includes - Using
aandmxwhen ip4/ip6 would work fine - Accumulating marketing and transactional sender includes over time
If you hit the limit, flatten your SPF record by replacing include: chains with direct ip4: entries, or use an SPF flattening service.
SPF vs DKIM vs DMARC
| Feature | SPF | DKIM | DMARC |
|---|---|---|---|
| What it checks | Sending server IP | Cryptographic signature on message | Alignment of SPF/DKIM with From header |
| Where it's published | example.com TXT | selector._domainkey.example.com TXT | _dmarc.example.com TXT |
| Survives forwarding | No — IP changes | Yes — signature travels with email | Depends on DKIM passing |
| Provides reporting | No | No | Yes (rua/ruf) |
| Stops spoofing alone | Partially | Partially | Yes (with p=reject) |
SPF, DKIM, and DMARC work together. SPF alone is not enough — use all three.
→ See also: DKIM Record, DMARC Record, TXT Record
Frequently Asked Questions
Can I have multiple SPF records?
No. You must have exactly one SPF record (one TXT record starting with v=spf1) per domain. Multiple SPF records cause a PermError and break delivery. Combine all your senders into one record.
My SPF passes but emails still land in spam — why?
SPF alone is not enough. You also need DKIM (cryptographic signature) and DMARC (alignment policy). Without DKIM, forwarded emails will fail SPF and hurt deliverability.
Should I use ~all or -all?
Start with ~all (softfail) while you're getting set up — it won't cause hard bounces if you missed a sender. Switch to -all (hard fail) once you've confirmed all your sending sources are in the record.
What is SPF alignment?
DMARC requires SPF alignment: the domain in MAIL FROM must match the From: header domain. If your ESP sends from a different envelope domain (common with bulk mailers), SPF alignment will fail and you'll need DKIM to pass DMARC.
Does SPF work on subdomains?
SPF records are per-domain. Each subdomain that sends email needs its own SPF record. Subdomains don't inherit the parent's SPF automatically.
What happens if I have no SPF record?
Without SPF, receiving servers have no policy to check. Some will accept the mail; others may apply stricter filtering. More importantly, anyone can spoof your domain. You should always publish an SPF record.
References
Related: How to Set Up an SPF Record · DKIM Record · DMARC Record · MX Record · TXT Record · Free SPF Checker