SPF record: what it is, how to write one
and how to check that it is valid
An SPF record is a text (TXT) line in your domain's DNS that lists which servers may send email on behalf of the domain. The receiving server checks it and decides whether to accept, flag or reject the message. A domain should have one valid record, within a limit of 10 DNS lookups, and it works best together with DKIM and DMARC.
Last updated: 28.10.2026 | Written and reviewed by the PhishingU team
What is an SPF record?
SPF (Sender Policy Framework) is an email authentication mechanism. The domain owner publishes in DNS a list of servers and services (such as Google Workspace, Microsoft 365 or an email marketing platform) that are allowed to send on its behalf. When a message arrives, the receiving email server compares the sending server's address with that list. SPF checks the technical envelope sender (Return-Path), not the name the user sees in the "From" field, so on its own it does not stop every impersonation attempt.
What does an SPF record look like?
An SPF record is a TXT record at the root of the domain. It starts with v=spf1, continues with a list of authorized sources, and ends with a rule that says what to do with everything else.
v=spf1 include:_spf.google.com ~allv=spf1Identifies the record as SPF version 1.include:Adds the authorized server list of an external provider.ip4: / ip6:Allows a specific IP address or range of addresses.~allAll other senders are treated as suspicious (softfail). With -all everything else is rejected (fail).
Examples by mail provider
These values were current when this page was published. Check the provider's official documentation before you change a live record.
Google Workspace
v=spf1 include:_spf.google.com ~allMicrosoft 365
v=spf1 include:spf.protection.outlook.com -allBoth providers together
v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~allIf you also send from an email marketing platform or a billing system, add its include to the same record. Do not create a second record.
Common SPF mistakes
Two SPF records for the same domain
More than one SPF record causes a PermError and the check fails. Merge everything into one record.
More than 10 DNS lookups
The standard limits a record to 10 DNS lookups (include, a, mx, redirect and others). Each provider include adds lookups, and going over the limit makes the check fail. Check the record and remove providers you no longer use.
Using +all or ?all
These settings allow every sender (+all) or give no verdict on any sender (?all), so the record provides no real protection. A common approach is to start with ~all and move to a hard fail (-all) only once you have confirmed that every legitimate sender is on the list.
A legitimate sender missing from the list
A billing system, email marketing tool or CRM that sends on behalf of the domain but is not included in the record can cause legitimate email to be rejected or land in spam.
Assuming SPF is enough
SPF does not protect the "From" field the user sees. To reduce impersonation of the domain you also need to set up DKIM and DMARC.
SPF, DKIM and DMARC: how they work together
SPF authorizes the sending server, DKIM signs the content of the message, and DMARC decides what to do when the checks fail and sends reports to the domain owner.
Full explanation and a check of all three recordsFrequently asked questions about SPF records
Want to know where your domain stands?
A free initial check with no commitment, and a practical recommendation for next steps.