SPF records, explained

Q: I use multiple email services: how do I include all of them?

Add each service's include: statement to your single SPF record. For example: v=spf1 include:_spf.google.com include:servers.mcsv.net ~all. If you're not sure what to include, let us know which services you use and we'll help.

Your email may look legitimate to you, but if receiving servers don't recognize who sent it, they'll treat it with suspicion. An SPF record is a simple DNS entry that tells the internet which mail servers are authorized to send email from your domain. This guide explains exactly what it is and why it matters.

What SPF stands for

SPF stands for Sender Policy Framework. The current specification is RFC 7208, published in 2014, and it's now a basic requirement for good email deliverability.

How SPF works

You send an email from you@yourbusiness.com using Google Workspace.

The recipient's mail server takes the sending domain from the envelope sender: the address the sending server hands over during delivery, which SPF calls MAIL FROM. For normal business email this is your own domain, but it isn't always identical to the From: line your reader sees.

The server looks up that domain's SPF record in DNS. SPF records are published as TXT records.

It checks whether the IP address of Google's sending server is on the authorized list.

If the IP is listed: the email passes SPF, and the recipient's other checks carry on from there. If it's not listed: the email may be marked as suspicious or rejected. What actually happens depends on the receiving system, on whether your record ends in ~all or -all, and on your DMARC policy.

SPF and DKIM are two separate checks on the same email: one on the sending server, one on the signature. DMARC is not a third check: it is the policy that tells receiving servers what to do with emails that fail SPF or DKIM.

Read this as text

An email arrives claiming to be from your domain. The receiving mail server runs two checks on it. SPF checks the envelope: is this mail server on the approved list? DKIM checks the letter: was this email signed by the claimed domain, and is the signature still intact?

If both checks pass, the email has been authenticated and there is nothing for your DMARC policy to act on. Authentication on its own is not a promise of the inbox: spam filters also weigh things like your message content.

If either check fails, your DMARC policy tells the receiving server what to do. A policy of none delivers the email anyway and sends reports to you as the domain owner. Quarantine puts it in the spam or junk folder. Reject blocks it entirely, so it never reaches the recipient.

What an SPF record looks like

An SPF record is a TXT record added to your DNS. Here are common examples:

Google Workspace:

v=spf1 include:_spf.google.com ~all

Microsoft 365:

v=spf1 include:spf.protection.outlook.com -all

Multiple senders (e.g., both Google and Mailchimp):

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

Breaking down the parts

Part	What it means
`v=spf1`	Declares this is an SPF record version 1
`include:domain`	Treats a pass in that domain's own SPF record as a pass for yours
`~all`	Soft fail: unauthorized senders should be accepted but marked (spam, Junk, or flagged)
`-all`	Hard fail: unauthorized senders aren't allowed to send for the domain, so the messages should be rejected
`+all`	Allow any sender (very insecure, never use this)

The `~all` vs `-all` choice

The two big providers give different advice here, so there's no single right answer.

Google recommends ~all for Google Workspace domains.
Microsoft recommends -all for Microsoft 365 domains, on the grounds that you should have DKIM and DMARC set up too, and DMARC can only act properly on a hard fail when a message has no DKIM signature.

Either way, follow the guidance of whoever runs your email, and make sure every service that sends on your behalf is authorized first. A hard fail on an incomplete record is what gets legitimate email rejected.

One SPF record per domain

You can only have one SPF record per domain. If you need to authorize multiple sending services (your email provider, a newsletter tool, a CRM), combine them all into one record using multiple include: statements, as shown above.

Don't create duplicate SPF records

If your domain has more than one TXT record starting with v=spf1, the check returns a permanent error instead of a pass. All senders must be combined into a single SPF record.

Do I need to create this myself?

Not usually. We add or update SPF records as part of setting up email hosting, migrating email providers, or configuring email marketing tools. If you're seeing deliverability issues, we can check your SPF record and fix it.

Common questions

My emails are going to spam. Is SPF the problem?

It might be one factor. Check whether your domain has an SPF record using any public SPF lookup tool, or ask us to check it. But deliverability issues can also be caused by missing DKIM or DMARC records, your email content, or your sending reputation. See Email DNS records.

I use multiple email services: how do I include all of them?

Add each service's include: statement to your single SPF record. For example: v=spf1 include:_spf.google.com include:servers.mcsv.net ~all. If you're not sure what to include, let us know which services you use and we'll help.

What is the SPF lookup limit?

SPF allows only 10 terms that trigger a DNS lookup in a single check. Each include: counts as one, as do a, mx, ptr, exists and redirect. Go over the limit and the check returns a permanent error rather than a pass: Google puts the same rule plainly: an SPF record can have up to 10 include: tags. If you use many email services, we can help optimize your record.

Will SPF alone stop my emails going to spam?

SPF is one part of a three-part system. You also need DKIM and DMARC for best deliverability. See DKIM records, explained and DMARC records, explained.