What is SPF, and how do you set it up?

What an SPF record looks like

An SPF record is a single TXT record at the root of your domain. It starts with v=spf1, lists who may send, and ends with a rule for everyone else:

v=spf1 include:_spf.google.com include:amazonses.com ~all

• include:_spf.google.com says “whatever Google Workspace says is allowed, is allowed.” Each service you send through gives you an include like this.
• ip4:203.0.113.5 allows one address of your own, if you run your own mail server.
• ~all at the end says “anyone else is probably not me” (a soft fail). -all says “definitely not me” (a hard fail). Never use +all: it allows the whole internet.

What SPF actually checks

SPF checks the envelope sender, also called the return-path or MAIL FROM, which is not the “From” address people see in their inbox. That is why SPF alone cannot stop someone forging your visible address. DMARC closes that gap by requiring the checked domain to match the visible one.

SPF also breaks when mail is forwarded, because the forwarding server is not on your list. This is normal, and it is one reason you also need DKIM, which survives forwarding.

The mistakes that break SPF

• Two SPF records. A domain must have exactly one. With two, receivers treat SPF as broken. Merge them into a single record.
• More than 10 DNS lookups. Every include, a, mx, ptr, exists and redirect counts, including the ones inside the records you include. Over 10, the whole record fails. Remove services you no longer use.
• A service missing from the list. If you send through a newsletter tool or an email API and it is not in your SPF, its mail can fail.
• Using ptr. It is slow and discouraged.
• No all at the end. Without it, the record says nothing about mail from other servers.

How to set it up

1. List every service that sends email as your domain: your mailbox provider, your email API, your newsletter tool, your help desk.
2. Find the SPF include each one tells you to use.
3. Create one TXT record at your domain that starts with v=spf1, has each include, and ends in ~all.
4. Wait for DNS to update (often minutes, sometimes longer, depending on the record’s TTL), then check it. Run your domain through the free domain checker to see it.