How to set up an SPF record (and stay under 10 lookups)
SPF lists the servers allowed to send mail for your domain. One TXT record, every sender included, 10 DNS lookups at most, ending in ~all or -all.
Step by step, with screenshots: SPF record: syntax, examples and ~all vs -all →
Check your own domain
Our DMARC checker (email & DNS) tool runs these 3 checks and writes the record to add, free, in seconds.
What it is
An SPF (Sender Policy Framework) record is a TXT record in your domain's DNS that lists the servers allowed to send email for your domain. Receiving servers compare the sending server with that list and treat mail from anywhere else as suspicious.
SPF has hard limits: one record per domain, and at most 10 DNS lookups once every include, a, mx and redirect is followed (RFC 7208). Break either rule and receivers return a permerror, which counts as having no SPF at all. getReport checks that the record exists, stays within the limits and ends with ~all or -all. Your SPF is OK when every service that sends as your domain is included and the lookup count is 10 or less.
What a passing site looks like
- The domain publishes an SPF recordfail · −25 ptseffort S
- SPF syntax and lookup limit: passesfail · −15 ptseffort M
- SPF catch-all rule: passeswarning · −4 ptseffort S
1. No SPF record, so anyone can send email as your domain
Why it matters. SPF tells receiving servers which servers may send mail for your domain. Without it, spoofed mail is harder to reject and your real mail is more likely to land in spam.
- Add one TXT record at the domain root that starts with v=spf1, includes each service that sends for you (your mailbox provider, newsletter tool, shop) and ends with ~all.
- Keep it to one record; two SPF records make both invalid.
2. SPF syntax and lookup limit
Why it matters. A broken SPF record counts as no record at all. The most common break is more than 10 DNS lookups once every include is followed, which makes receivers give up with a "permerror".
- Remove include: entries for services you no longer use, and merge or flatten the rest until the count is 10 or less.
- Replace mx, a and ptr mechanisms with the ip4 or ip6 ranges they stand for when you are close to the limit.
3. SPF catch-all rule
Why it matters. The last term of an SPF record decides what happens to mail from servers you did not list. +all allows everyone, ?all says nothing, and a missing all leaves receivers guessing.
- End the record with ~all (soft fail) while you check your senders, then -all (fail) once every sender is listed.
Questions people ask
What is the SPF record syntax?
An SPF record is one TXT record that starts with v=spf1, lists the allowed senders and ends with an all rule. ip4: and ip6: allow addresses, include: pulls in a provider's list, a and mx allow your own servers, and ~all (soft fail) or -all (fail) covers everyone else. Terms are separated by spaces, and the record goes on the domain itself.
Can a domain have multiple SPF records?
No. A domain must have exactly one TXT record starting with v=spf1; with two or more, receivers return a permerror and SPF fails for all your mail. This often happens when a new email service tells you to add an SPF record and a second one gets created. Merge them into a single record instead.
What is an example of an SPF record?
For a domain that sends through Google Workspace and SendGrid: v=spf1 include:_spf.google.com include:sendgrid.net ~all. It allows Google's and SendGrid's servers and marks mail from anywhere else as a soft fail. Each email provider documents the include value to use; copy it exactly and keep every provider in the same record.
How do I add multiple senders to one SPF record?
Put every sender's include or IP address into the same record, before the all term, for example v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.5 ~all. Each include costs at least one of your 10 DNS lookups, and some providers use several, so remove services you no longer use and check the total after every change.