What Is an SPF Record?
SPF, short for Sender Policy Framework, is a TXT record in your domain's DNS that lists the servers allowed to send email for your domain. When Gmail, Yahoo or Outlook receives a message, it checks the sending server against this list. If the server is not on it, the mail can be marked as spam or rejected.
SPF is now a basic requirement. The Google email sender guidelines ask every sender to set up SPF or DKIM, and bulk senders need SPF, DKIM and DMARC together. The hard part is that most businesses send from several places, such as Google Workspace for staff, Brevo for newsletters and a website server for order emails, and all of them must sit in one record. This generator builds that one record, and the checker finds the mistakes that silently break SPF.
How to Create and Add Your SPF Record
- List every service that sends email with your domain in the From address: your mailbox provider, newsletter tool, CRM, shop and website.
- Tick those services or paste the include value each one gives you in its domain setup page. Add fixed server IP addresses if you have them.
- Start with
~all, then copy the record and the host. For the main domain the host is@. - Replace any existing SPF record in your DNS panel. Never add a second one next to it.
- Paste the live record into the checker after a few hours to confirm it is valid and under the lookup limit.
SPF Mechanisms Explained
| Term | Example | Lookups | What it does |
|---|---|---|---|
ip4 and ip6 | ip4:203.0.113.25 | 0 | Allows one address or a range. A single IPv4 address means /32 |
include | include:_spf.google.com | 1 plus nested | Allows every server in another domain's SPF record |
a and mx | mx | 1 | Allows the servers your domain's A or MX records point to |
exists and redirect | redirect=_spf.example.com | 1 | Advanced checks, and handing the whole policy to another domain |
ptr | ptr | 1 | Reverse DNS match. RFC 7208 says not to use it |
~all, -all | ~all | 0 | Ending for every other server: soft fail or fail |
The rules come from RFC 7208, the SPF standard. Microsoft explains the lookup count well in its SPF setup guide.
Practical Tips
- One record only. Two records starting with
v=spf1make SPF fail for every email. This is the most common SPF mistake, and the checker merges them for you. - Watch the 10 lookup limit. Every
include,aandmxcosts a lookup, and so does every include inside those records. Remove tools you stopped using. - Soft fail or fail? Google recommends
~alland Microsoft recommends-all. With a DMARC policy in place, both protect you, and~allis safer while you are still finding senders. - Subdomains need their own record. The record on your main domain does not cover
news.yourshop.in. - Some tools need no include. Many newsletter platforms send from their own bounce domain and only ask for DKIM. Follow your tool's setup page rather than guessing.
Finish Your Email Setup
SPF works best with DKIM and DMARC. Plan your sending with our email marketing strategy guide, and if your website sends mail from code, read how to send email in PHP and contact form spam protection in PHP. Then publish a policy for failing mail with the DMARC record generator and checker.
Frequently Asked Questions
1Can a domain have two SPF records?
No. A domain may have only one TXT record that starts with v=spf1. With two or more, receivers return a permanent error and SPF fails for all your mail. Combine every include and IP address into a single record instead.
2What is the SPF 10 DNS lookup limit?
RFC 7208 allows at most 10 DNS lookups while checking SPF. Every include, a, mx, ptr and exists term and the redirect modifier costs one, and includes inside included records count too. IP addresses and all cost nothing. Going over 10 makes SPF fail.
3Should I use ~all or -all?
~all (soft fail) asks receivers to treat unlisted senders as suspicious, and Google recommends it. -all (fail) asks them to reject such mail, and Microsoft recommends it. Start with ~all, and move to -all once you are sure every sender is listed.
4Where do I add the SPF record?
Add it as a TXT record in the DNS settings where your domain is managed, such as your registrar, hosting panel or Cloudflare. Use @ as the host for the main domain. If an SPF record is already there, edit it instead of adding a new one.