What goes in
Each service you send from has an “include” that lists its servers. Your own servers go in by IP address. Together they form one line, starting v=spf1 and ending with ~all or -all.
Build your SPF record.
Tick where your email is sent from, and get the exact record to add to your DNS.
The include your provider gives you. Separate several with spaces.
If you run your own mail server. IPv4 or IPv6, with an optional range.
Your SPF record
v=spf1 ~all- Type
TXT- Name
@(oryourcompany.com, depending on your DNS provider)- Value
- the line above, exactly
Pick at least one place your mail comes from. With none, this record says nobody may send as your domain.
A domain can have only one SPF record. If you already have one, merge these into it instead of adding a second. Nothing you enter here leaves your browser.
What it means.
Why it matters
Gmail, Yahoo and Microsoft expect SPF and DKIM on mail from every sender. Without them, your mail is more likely to be refused or filed as spam.
After you add it
Check the result with the domain checker. It reads your live record, counts the lookups, and tells you if anything is missing or wrong.
Common questions.
What is an SPF record?
It is a line of text in your domain’s DNS that lists the servers allowed to send email as your domain. Receivers check it, and mail from a server that is not listed is more likely to be marked as spam or refused.
Where do I add the record?
In the DNS settings of whoever runs your domain, which is often your registrar or a service like Cloudflare. Add a TXT record with the name @ (or your domain), and paste the value. Allow up to a few hours for it to spread.
I already have an SPF record. What do I do?
A domain can have only one. Do not add a second: that makes both invalid. Edit the one you have, and add the new include or IP address into it before the final ~all or -all.
What is the 10 lookup limit?
To check SPF a receiver looks up each include, a and mx in your record, and the ones inside the records you include. More than 10 in total and SPF fails with an error. The tool counts what you add; the services you include add their own, so keep the list short.
Should I end with ~all or -all?
~all (softfail) tells receivers that mail from anywhere else is suspicious. -all (hardfail) tells them to reject it. Start with ~all, and move to -all when you are sure every service that sends as your domain is listed. DMARC does most of the enforcing now, so ~all is a perfectly good place to stay.
Do I need to add SendSend to my SPF record?
No. SendSend sends with its own bounce address on a subdomain of yours, which it sets up when you verify the domain, so your main SPF record does not need to change for it. Add the records SendSend shows you when you verify a domain.
Does this send my domain anywhere?
No. The record is built in your browser from what you tick, and nothing is sent to us.
Next: Check your domain · Generate a DMARC record · What is SPF? · SPF has too many DNS lookups
Want to see where every email goes?
SendSend shows what happened to each message you send: delivered, bounced, or marked as spam. Free for 3,000 emails a month.