How to Set Up an SPF Record Correctly (Step-by-Step Guide)

If you've checked your email security and found that SPF is missing or misconfigured, you're not alone — roughly a third of all domains have an invalid SPF record. The good news: fixing it is straightforward once you understand how it works.

SPF (Sender Policy Framework) is a DNS record that tells receiving mail servers which IP addresses are allowed to send email on behalf of your domain. Without it, anyone can send mail that claims to be from you, and your legitimate email is more likely to land in spam.

Here's how to set it up properly, step by step.

Step 1: List Every Service That Sends Email as Your Domain

Before you write a single character of your SPF record, you need to know every service that sends email from your domain. The most common ones:

• Google Workspace or Microsoft 365 (your main email provider)
• Mailchimp, SendGrid, Mailgun, or Amazon SES (marketing or transactional email)
• Shopify, Salesforce, HubSpot, Zendesk (SaaS platforms that send receipts, notifications, or support replies)
• Your web host (contact forms or WordPress notifications)
• A calendar booking tool like Calendly or Acuity

Miss one, and the SPF record you write will cause that service's email to fail authentication once you set a hard fail policy.

Step 2: Understand the SPF Syntax

An SPF record is a single TXT record in your DNS. Here's what each part means:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

The two common endings are:

• ~all (softfail) — recommended while testing. Mail from unauthorized senders is marked suspicious but still delivered.
• -all (hard fail) — the strict setting. Mail from unauthorized senders is rejected. Use this only when you're confident all legitimate senders are listed.

Step 3: Find Your Provider's SPF Include Values

Every major email service publishes an SPF include value. Here are the most common:

Step 4: Assemble Your Record

Combine all your include: statements in any order. For a small business using Google Workspace and Mailchimp, the record might look like:

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

Add it as a TXT record at the root of your domain (not a subdomain). The name should be @ or your bare domain, not _spf or anything else — just yourdomain.com.

Step 5: Check the 10-Lookup Limit — This Is the Trickiest Part

SPF has a hard limit of 10 DNS lookups per evaluation. Every include:, a:, mx:, ptr:, or exists: mechanism counts as one lookup. If you exceed 10, SPF silently fails — and your record stops working entirely.

Most services' include values resolve to multiple lookups themselves. Google's _spf.google.com currently resolves to 3 lookups. Microsoft 365 resolves to 4 or more. If you have three or four services, you can blow the limit fast.

What to do if you hit the limit:

• Use ip4: and ip6: directly instead of include: where possible (these don't count toward the lookup limit)
• Consolidate with a third-party SPF flattening service or automate flattening yourself
• Consider whether you really need every service listed — some old integrations may no longer send mail

Step 6: Publish and Test

Add the TXT record through your DNS provider (Cloudflare, GoDaddy, Namecheap, AWS Route 53, etc.). Propagation usually takes a few minutes but can take up to 48 hours.

Once published, test it by sending an email and checking the headers for Received-SPF: pass. You can also test your record instantly with free online SPF validators.

Step 7: Move from Softfail to Hard Fail

Run with ~all for at least a week. Monitor your email delivery. If nothing breaks — no bounced invoices, no missing form submissions — switch to -all:

v=spf1 include:_spf.google.com include:servers.mcsv.net -all

This tells the world that only your listed senders are legitimate, and anything else should be rejected.

A Note About SPF Alone

SPF has a weakness: forwarded email. When mail is forwarded, the original sender's SPF check happens against the forwarding server's IP, which isn't authorized — so SPF fails. That's normal, and it's why you also need DKIM (which survives forwarding). SPF works best as one leg of a three-legged stool: SPF + DKIM + DMARC.

Check Your SPF Right Now

If you're not sure whether your SPF record is correct — or even exists — the fastest way to find out is to scan your domain. A good scanner will tell you the exact record, whether it has syntax errors, whether you're over the lookup limit, and what needs to change.

That's exactly what this tool does: enter your domain and get an instant check on SPF, DKIM, DMARC, and MX records, with a clear fix plan for anything wrong.

How does your domain score?

Check your DMARC, SPF, DKIM & MX records in seconds — free, no signup.

Scan your domain