Email DNS explained
What is an SPF record?
SPF (Sender Policy Framework) is a TXT record that lists the servers and services allowed to send email from your domain. Receivers use it to spot mail that pretends to come from you.
How SPF works
Your SPF record starts with v=spf1, lists who may send (usually as include: entries for each service) and ends with an all rule that says what to do with everyone else. A receiving server compares the server that sent a message against this list.
Gmail asks every sender to use SPF or DKIM. Mail that passes neither can land in spam or be rejected.
Source: RFC 7208: SPF (IETF), Email sender guidelines (Gmail Help)
Only one SPF record per domain
A domain must publish exactly one SPF record. Two records make SPF fail for every message. If you send through more than one service, combine them in one record, for example v=spf1 include:_spf.google.com include:example-mailer.com ~all.
Source: RFC 7208: SPF (IETF), Set up SPF for your Microsoft 365 domain (Microsoft Learn)
The 10-lookup limit
Checking an SPF record may use at most 10 DNS lookups, counting every include, a, mx, ptr, exists and redirect, including the ones inside included records. Go over and SPF fails. Our checker counts them for you.
Source: RFC 7208: SPF (IETF)
~all or -all?
~all (soft fail) asks receivers to treat other senders with suspicion; -all (fail) says they are not allowed. Providers differ: Google recommends ~all, Microsoft recommends -all together with DKIM and DMARC.
Source: RFC 7208: SPF (IETF), Set up SPF (Google Workspace Help), Set up SPF for your Microsoft 365 domain (Microsoft Learn)
SPF for your email provider
The exact values and steps for each provider:
SPF: questions
What is a good SPF record?
One record that starts with v=spf1, lists every service that sends mail for you with include:, stays within 10 DNS lookups and ends with ~all or -all, as your email provider recommends.
Do I need SPF if I have DKIM?
Gmail asks every sender for at least one of them, and senders of 5,000 or more messages a day to Gmail for both, plus DMARC. Setting up both is the safest choice.
Can I have two SPF records?
No. Two SPF records make SPF fail for every message. Merge every include into a single record that starts with v=spf1.
Do I need SPF if my provider forwards my mail?
You need SPF for the services that send mail as your domain. A service that only receives and forwards mail may not need its own include. Your provider’s setup guide says which value to use.
Ready to set it up?
Pick your email provider and DNS host to get the exact records and steps.