An SPF record is a short line of text in your domain's DNS that lists the servers allowed to send email for that domain. When a message arrives, the receiving server reads the record and checks whether the sending server is on the list. It is one of the three basic email authentication standards, alongside DKIM and DMARC, and one of the first things mailbox providers look at when they decide whether to trust your mail. This guide explains what an SPF record is, how its syntax works, how to create one, how to check and test it, and how to fix the errors that most often break it.
What is an SPF record?
SPF stands for Sender Policy Framework. It lets the owner of a domain publish, in DNS, the list of mail servers and services that may send mail using that domain in the envelope sender address. A receiving server looks up the record, compares the connecting IP address with the list and gets one of several results: pass, fail, softfail, neutral, none, temperror or permerror. The receiver then decides what to do. Many providers use the result as one signal among several, together with DKIM, DMARC and the sender's reputation.
SPF has a limit worth knowing from the start. It checks the envelope sender, also called the return-path or MAIL FROM address, and not the visible From address that people see. DMARC is what ties the two together through alignment. For the full picture, read email authentication explained.
SPF record syntax
An SPF record is a single line made of a version tag followed by mechanisms, each optionally preceded by a qualifier. A typical record looks like this:
v=spf1 ip4:203.0.113.10 include:mail.example.net mx ~all
The version tag
v=spf1 must come first. It tells receivers that the text is an SPF record. A TXT record that does not start with it is ignored by SPF.
Mechanisms
| Mechanism | What it matches | Counts toward the lookup limit? |
|---|---|---|
ip4: and ip6: | A specific address or range | No |
a | The address records of the domain, or of another named domain | Yes |
mx | The mail exchangers of the domain | Yes |
include: | Whatever the named domain's own SPF record allows | Yes |
exists: | Any address returned by a DNS lookup of the named domain | Yes |
ptr | Reverse DNS names; the standard discourages its use | Yes |
all | Everything not matched earlier | No |
A redirect= modifier sends the check to another domain's record and also counts toward the limit.
Qualifiers
A qualifier is the symbol in front of a mechanism. If you leave it out, it defaults to a plus sign.
- + pass. The default.
- - fail. Mail from other sources should be rejected. This is a hard fail.
- ~ softfail. Mail from other sources is suspicious but may be accepted.
- ? neutral. No statement either way.
The "all" ending
Records end with all and a qualifier. -all is the strictest, ~all is the common middle ground while you are still finding all your senders and ?all says almost nothing. Never use +all, which authorises the entire internet to send as you.
How to create an SPF record
- List every system that sends mail for your domain. Include your main mailbox provider, your sending service, your help desk, your CRM, your billing system, website forms and any server that sends alerts. Missing one means its mail fails SPF.
- Get the SPF information for each. Cloud services publish an include value in their documentation or in the domain settings of your account. A server you run yourself is listed by IP address with
ip4:orip6:. Do not guess include values; copy them from the provider. - Combine them into one record. One domain must have only one SPF record, so all senders go on one line.
- Choose the ending. Start with
~allif you are unsure you have found every sender, and move to-allwhen you are confident. - Publish it as a TXT record at the root of the domain, which many DNS panels show as "@" or leave blank in the host field.
- Wait for DNS to update and then test. Changes usually appear within minutes to a few hours, depending on the time-to-live of the old record.
Example for a company that uses Google Workspace for mailboxes and one other sending service:
v=spf1 include:_spf.google.com include:mail.sender-example.net ~all
If you send with MigoSMTP, add the include value shown in your domain settings in the dashboard. We do not list it here because it can differ by setup, and you should always copy the value from your own account. Our guide to authenticating your sending domain walks through the full set of records, and DNS records for email explains where each one goes.
How to check an SPF record
With an online tool
The quickest way is a checker that reads the record, validates the syntax, follows the includes and counts the lookups. Use our SPF, DKIM and DMARC checker and enter your domain.
From the command line
# Linux or macOS dig +short TXT example.com # Windows or any system with nslookup nslookup -type=TXT example.com
Look for the line that begins with v=spf1. If you see two lines starting that way, you have a problem described below. If you see none, the domain has no SPF record.
From a real message
Send a test message to a mailbox you control and open the message headers. Look for the authentication results line, which will show spf=pass, spf=fail or another result, and the domain it checked. Our guide to reading email headers shows where to look.
Common SPF problems and how to fix them
More than one SPF record
If a domain publishes two records that begin with v=spf1, receivers return a permanent error and SPF fails for all of your mail. This often happens when different people add records for different services. Merge them into one line.
Too many DNS lookups
The standard limits an evaluation to ten DNS lookups caused by include, a, mx, ptr, exists and redirect, counting those nested inside includes. Going over produces a permanent error. Remove services you no longer use, replace a and mx with direct IP ranges where the addresses are stable, and read our guide to SPF for multiple senders and the 10 lookup limit.
A missing sender
Legitimate mail fails because the sending system is not on the list. Check the headers of a failing message for the IP address that connected, find which service it belongs to and add it.
Syntax mistakes
Typical examples are a missing space between mechanisms, a stray quote mark pasted from a document, v=spf without the 1, or an include with a typo. A checker finds these immediately.
Record too long
A single DNS string is limited to 255 characters. A longer SPF record is stored as several strings in the same TXT record, which DNS software joins together. Most DNS panels do this for you, but some need the record entered in separate quoted parts. If a record is very long, you probably have too many senders.
Wrong record type or place
SPF belongs in a TXT record, not in the obsolete SPF record type, and at the exact domain that appears in the envelope sender. A subdomain that sends mail needs its own record unless it has none and you are happy for the policy to be absent.
Forwarded mail fails
When a message is forwarded, it comes from the forwarder's server, which is not in your record, so SPF fails. This is normal, and it is why DKIM and ARC exist. See email forwarding explained.
SPF and the rest of your authentication
SPF alone is not enough. Pair it with DKIM, which signs each message, and with a DMARC policy, which tells receivers what to do when both checks fail to align with the visible From domain. Bulk senders to major mailbox providers are expected to have all three. After you have published SPF, set up DKIM and then move on to DMARC. If you are fixing a reputation problem, read email reputation too.
SPF best practices
- Keep exactly one SPF record per sending domain and subdomain.
- Only list what you actually use, and review the record when you change tools.
- Prefer
ip4andip6for servers you own, and includes for services you rent. - Stay well below the ten-lookup limit so a provider's change does not break you.
- Move from
~allto-allonce you have verified your senders. - Publish a record even for domains that never send mail:
v=spf1 -allsays that no server is authorised, which helps against spoofing. - Recheck after every new tool, migration or DNS change.
Check your SPF record now Validate the syntax, follow the includes and count the lookups for your domain.
References and further reading
Frequently asked questions
What is an SPF record?
A TXT record in your domain's DNS that lists the servers and services allowed to send email for that domain. Receiving servers check it to decide whether a message came from an authorised source.
How do I check my SPF record?
Use an SPF checker, run dig +short TXT or nslookup -type=TXT on your domain and look for the line starting with v=spf1, or read the authentication results in the headers of a test message.
Can a domain have more than one SPF record?
No. Two records starting with v=spf1 cause a permanent error and SPF fails. Merge all senders into one record.
What is the difference between ~all and -all?
~all is a softfail that treats unlisted senders as suspicious, and -all is a hard fail that says they are not authorised. Many senders start with ~all and move to -all once all senders are confirmed.
Why does SPF fail for forwarded email?
A forwarded message comes from the forwarder's server, which is not in your record. DKIM and ARC are designed to handle this case.