SPF record: syntax, examples and ~all vs -all

An SPF record is a TXT record in your domain's DNS that lists the servers allowed to send email for your domain, such as v=spf1 include:_spf.google.com ~all. Receiving servers compare the server that delivered a message with that list, and treat mail from anywhere else as a soft fail (~all) or a fail (-all). A domain has exactly one SPF record, and it must stay within 10 DNS lookups.

This guide is for whoever edits the domain's DNS and has been asked to "add SPF" or to add a new sender to it. It covers the syntax term by term, examples you can copy, and the ~all versus -all decision. SPF is the first of three records; the SPF, DKIM and DMARC setup guide shows where it fits alongside DKIM and DMARC.

Quick answer

• Where: one TXT record at the domain root (host @ in most DNS panels).
• Shape: v=spf1, then the allowed senders, then one all term at the end.
• Senders: include: for a provider's list, ip4:/ip6: for your own addresses.
• Ending: ~all (softfail) while you confirm your senders; -all (fail) when the list is complete. Never +all.
• Limits: one SPF record per domain, and at most 10 DNS lookups across all includes, or SPF fails with permerror.
• What it does not do: protect the From address your recipients see. That takes DMARC, which uses SPF and DKIM.

What SPF checks, and what it does not

SPF (Sender Policy Framework) is defined in RFC 7208. When a server connects to deliver mail, the receiver takes the domain from the envelope sender (the MAIL FROM address, which ends up in the Return-Path header), fetches that domain's SPF record, and checks whether the connecting IP address is on the list.

Two things follow from that:

• SPF checks the bounce address, not the From line. Many newsletter and transactional services send with their own bounce domain, so your SPF record never comes into play for them. They authenticate your domain with DKIM instead.
• SPF breaks when mail is forwarded. The forwarding server is not on your list, so the forwarded copy fails. DKIM survives forwarding; SPF does not.

That is why SPF alone is not enough, and why DMARC accepts either SPF or DKIM.

SPF record syntax

An SPF record is one line of space-separated terms, read left to right. The first term that matches the sending IP decides the result, so the order matters only for the all at the end.

example.com.  3600  IN  TXT  "v=spf1 include:_spf.google.com ip4:203.0.113.25 ~all"

Version

v=spf1 must be the very first thing in the record. A TXT record that does not start with it is not an SPF record.

Mechanisms: who is allowed

Qualifiers: what a match means

Each mechanism can have a prefix that sets the result when it matches. Without one, + (pass) is assumed.

Modifiers

• redirect=domain uses another domain's SPF record instead of this one, when nothing else matched. Handy when many domains share one policy; it counts as a lookup.
• exp=domain points to an explanation text for rejected mail. Rarely used.

The limits

• One record. Two TXT records starting with v=spf1 make SPF return permerror for every message.
• 10 DNS lookups. Every include, a, mx, ptr, exists and redirect counts, including the ones inside included records. Past 10, receivers return permerror.
• 2 void lookups. RFC 7208 also recommends failing after more than two lookups that return nothing, which catches includes pointing at deleted records.
• 255 characters per string. A longer record is split into several quoted strings inside the same TXT record; receivers join them without spaces, so leave a space at the end of the first string.

Merging duplicate records and getting back under 10 lookups is a job of its own; the SPF, DKIM and DMARC setup guide covers both.

SPF record examples

Each example is the complete value of the one TXT record at your domain root. Copy the include values from your provider's own help page, because they occasionally change.

Google Workspace only:

v=spf1 include:_spf.google.com ~all

Microsoft 365 only:

v=spf1 include:spf.protection.outlook.com -all

Google Workspace, a helpdesk and your own web server:

v=spf1 include:_spf.google.com include:mail.zendesk.com ip4:203.0.113.25 ~all

The ip4: covers contact-form and order mail sent directly from the web server. It costs no lookup, unlike a.

A domain that never sends email:

v=spf1 -all

Publish this on parked domains and redirect-only domains, together with a DMARC record of v=DMARC1; p=reject. It tells receivers that no server may send as the domain.

Newsletter mail on a subdomain:

; On news.example.com, separate from the root record
v=spf1 include:sendgrid.net ~all

A subdomain has its own SPF record and its own 10 lookups, which is a clean way to keep the root record short. Only add an include like this when the service's setup page asks for one; many services need DKIM records only.

SPF softfail vs hardfail: ~all or -all?

The all at the end decides what happens to mail from any server you did not list.

On its own, SPF gives no instruction to reject or deliver; receivers decide. In practice, a softfail usually counts against the message in spam filtering, and a hardfail may be rejected outright.

Which to use:

• Start with ~all. While you are still finding every service that sends as you, a softfail on a forgotten sender costs spam-folder placement, not a bounce.
• Move to -all when the list is complete and your DMARC reports show every real sender passing.
• Once DMARC enforces, the difference is small. DMARC makes the final decision, and it looks at whether SPF or DKIM passed and aligned, not at soft versus hard.

One reason many administrators keep ~all even at p=reject: some receivers reject a -all failure during the SMTP conversation, before DMARC can see that DKIM passed. Forwarded mail, which fails SPF but keeps a valid DKIM signature, is the usual casualty. If you rely on DKIM for forwarded mail, ~all is the safer ending.

How to add or change your SPF record

1. Look for an existing record. In your DNS panel, filter TXT records at the root for v=spf1. If one exists, you edit it; you never add a second.
2. List every sender. Your mailbox provider, and any service that sends as your domain with its own servers and asks for an include: helpdesk, CRM, invoicing, web server.
3. Write the record. v=spf1, the includes and IP ranges, then ~all.
4. Save and check the lookup count. Some providers' includes use several lookups each, because their record includes further records; count them with a tool rather than by hand.
5. Send a test message to a Gmail address, choose Show original, and look for SPF: PASS with your domain.

How to check your SPF record

The email and DNS health check finds your SPF record, follows every include to the end, counts the DNS lookups and reads the all ending. When something is wrong, it writes the corrected record for you.

From a terminal:

dig +short TXT example.com | grep spf1
nslookup -type=txt example.com

Common SPF mistakes

• A second SPF record added by a new service's setup wizard. Merge its include into the existing record and delete the extra one.
• Over 10 lookups after adding one service too many. Remove includes for services you no longer use, and replace a and mx with ip4: ranges.
• +all or ?all copied from an old tutorial. Both leave the domain open.
• An include for a service that does not need it. It costs lookups and changes nothing, because the service sends with its own bounce domain.
• SPF only on www. Mail uses the root domain (or the subdomain in the sender address), not www.
• Quotes or v=spf1 typed twice when the DNS panel adds quotes itself.

Questions people ask

What is an SPF record?

An SPF record is a TXT record at your domain root that lists the servers allowed to send mail for it, such as v=spf1 include:_spf.google.com ~all. Receivers compare the sending server with that list. A domain may have only one SPF record, and it must stay within 10 DNS lookups, or SPF fails for every message you send.

What is the difference between ~all and -all?

~all is a softfail: mail from servers not on your list is marked as suspicious but usually still accepted, often into spam. -all is a hardfail: such mail should be treated as not from you, and some receivers reject it outright. Start with ~all while you confirm your senders, and switch to -all once your list is complete.

What does SPF softfail mean?

Softfail means the server that sent the message is not in the domain's SPF record, and the record ends with ~all, so the domain says the mail is probably not legitimate without asking for rejection. Receivers usually accept it but weigh it against the message. If your own mail shows softfail, add the sending service to your SPF record or send it with DKIM.

Where do I add an SPF record?

At your DNS provider, which is often your domain registrar, Cloudflare or your web host. Create a TXT record at the root of the domain, usually shown as host @ or left blank, with the SPF value. Your email provider only tells you what to include; the record itself must be in public DNS for receivers to find it.

Do I need an SPF record if my domain sends no email?

Yes. Publish v=spf1 -all, which says no server is allowed to send for the domain, and add a DMARC record with p=reject. Without them, a parked or unused domain is an easy one to forge in phishing, because receivers have no way to tell that mail from it cannot be genuine.

Does SPF work with forwarded email?

No, SPF usually fails on forwarded mail, because the forwarding server delivers the message from its own IP address, which is not in your SPF record. That is why DKIM matters: its signature travels with the message and normally survives forwarding, so DMARC can still pass. Some forwarders rewrite the envelope sender (SRS) so SPF passes for their own domain instead.