Guides SPF
What is SPF?
SPF (Sender Policy Framework) is a short line of text you publish in your domain's DNS. Think of it as a guest list at the door: only the mail servers on the list may send email for your domain. When a receiving server gets a message that claims to be from you, it checks the list. If the sending server isn't on it, that's a strong sign of abuse. SPF only judges the sending server. DKIM proves the message wasn't altered in transit, and DMARC covers whether the visible sender address holds up.
What does SPF actually do?
Your domain has DNS: a kind of phone book that says where your website and mail live. In that DNS you put one small TXT record (just a piece of text) starting with v=spf1. After it you list which mail servers may send for you, and at the very end what should happen with everything else.
When someone receives a mail from 'your' domain, the receiving server runs an automatic check: it looks at the IP address (the 'house number' on the internet) of the sending server and compares it to your list. On the list → pass. Not on it → the closing rule kicks in: usually 'suspicious' (softfail) or 'reject' (fail).
Note: SPF checks the hidden 'envelope' sender (technically MAIL FROM), not the From address the recipient sees in their mail app. That difference is exactly why you need SPF, DKIM and DMARC together.
What does an SPF record look like?
A typical record: v=spf1 include:_spf.google.com ~all. Piece by piece:
v=spf1: says this is an SPF record (required at the start)include:_spf.google.com: 'also accept Google's servers'. This adds a whole provider in one go~all: the closing rule, everything else is softfail (suspicious)
The building blocks you can use:
aandmx: the servers behind your domain's A and MX recordsip4:andip6:: individual IP addresses or whole ranges, e.g.ip4:192.0.2.0/24include:: references a provider's SPF record- the sign before
allsets the strictness:-all(hard reject),~all(softfail),?all(neutral),+all(allow everything, never do this)
The 10-lookup limit
SPF has an important limit: while being checked it may cause at most 10 DNS lookups. Every include:, a, mx, ptr, exists and redirect= counts, and an include can contain includes of its own, so it adds up faster than you'd think.
Go over 10 and the check stops with a permerror (permanent error). From that point receivers treat your mail as if you had no SPF at all, even though your list is correct. Use Google, Microsoft 365 and a newsletter tool together, and you'll hit it easily.
Fixes: remove includes you no longer use, or 'flatten' the record by replacing includes with the underlying ip4:/ip6: ranges. The downside: those ranges can change at the provider, so then you have to keep them up to date yourself.
Why you need this
Without SPF anyone can send mail that claims to be from your domain, and receivers have no way to stop it. Scammers use this for phishing and spam in your name.
SPF is also the foundation DMARC leans on: without a passing SPF or DKIM check, DMARC can't pass. A correct record lowers the chance your own mail gets filed as spam, and it's the stepping stone to a strict DMARC policy. Since 2024, Gmail and Yahoo also only accept mail from domains with at least SPF or DKIM.
Common mistakes
- Publishing more than one SPF record: that's a
permerror. Everything belongs in one record - Going over the 10 DNS-lookup limit (see above)
- Closing with
+all: that lets anyone send as you. About as bad as having no SPF - Forgetting a sender (newsletter tool, CRM, accounting software), making real mail suddenly fail
- Using
ptr: deprecated, slow and unreliable. Avoid it
Setting it up step by step
- Make a list of every service that sends for your domain: your mail provider, newsletter tool, CRM, web shop, invoicing system
- For each, look up which
include:orip4:/ip6:they require (it's in their docs) - Combine everything into one record, e.g.
v=spf1 include:_spf.google.com include:servers.mcsv.net ~all - Close with
~allwhile in doubt, and with-allonce you're sure the list is complete - Publish it as a TXT record on your main domain and wait for it to propagate (can take a few hours)
- Verify the result with the DNS Radar scan: it also counts the lookups for you
Frequently asked questions
What's the difference between ~all and -all?
-all says everything not listed is a failure (hardfail). ~all is a softfail: suspicious, but not outright rejected. -all is stricter. Use it once you know all your senders.
Is SPF enough to stop spoofing?
No. SPF checks the envelope sender domain, not the visible From. You need SPF, DKIM and DMARC together to block spoofing of your visible address.
Can I have multiple SPF records?
No. A domain should have exactly one SPF record. Multiple v=spf1 records produce a permerror. Merge all senders into that single record.
Do I need SPF if my domain sends no mail?
Yes. Publish v=spf1 -all. That explicitly declares no server may send for this domain, which stops scammers from abusing it.
My SPF has too many lookups. What now?
Remove includes you no longer use, replace includes with their ip4:/ip6: ranges (flattening), or give separate sending streams their own subdomain with its own SPF record.