SPF Records Guide: Syntax & Setup

What Is SPF?

SPF (Sender Policy Framework) is a DNS-based email authentication method that specifies which mail servers are authorized to send email on behalf of your domain. It helps prevent email spoofing and improves deliverability.

How SPF Works

You publish an SPF record in your domain's DNS
When a receiving server gets an email from your domain, it checks the SPF record
If the sending server's IP matches the SPF record, the email passes SPF

Sender: [email protected]
Sending Server: 198.51.100.5

DNS lookup: example.com TXT
SPF record: "v=spf1 ip4:198.51.100.0/24 -all"

Result: PASS ✓ (IP is in the allowed range)

SPF Record Syntax

An SPF record is a TXT record in DNS. It starts with v=spf1 and contains mechanisms:

v=spf1 ip4:198.51.100.0/24 include:_spf.google.com -all
│      │                    │                        │
│      │                    │                        └─ Fail everything else
│      │                    └──────────────────────── Include Google's SPF
│      └───────────────────────────────────────────── Allow this IP range
└──────────────────────────────────────────────────── SPF version 1

Mechanisms

Mechanism	Example	Description
`ip4`	`ip4:198.51.100.5`	Allow specific IPv4 address or range
`ip6`	`ip6:2001:db8::/32`	Allow specific IPv6 address or range
`include`	`include:_spf.google.com`	Include another domain's SPF
`a`	`a`	Allow the domain's A record IP
`mx`	`mx`	Allow the domain's MX record IPs
`all`	`-all`	Match everything (used at the end)

Qualifiers

Qualifier	Meaning	Result
`+` (default)	Pass	Allow
`-`	Fail	Reject
`~`	SoftFail	Accept but mark
`?`	Neutral	No policy

Common Examples

Google Workspace Only

v=spf1 include:_spf.google.com -all

Google + Mailchimp

v=spf1 include:_spf.google.com include:servers.mcsv.net -all

Direct Server + Google

v=spf1 ip4:198.51.100.5 include:_spf.google.com -all

Common Mistakes

Multiple SPF records — Only one TXT record with v=spf1 per domain
Using +all — This allows anyone to send as your domain (defeats the purpose)
Too many DNS lookups — SPF has a 10 DNS lookup limit (include, a, mx each count)
Forgetting third-party senders — Marketing tools, CRMs, and transactional email services need to be included

SPF Records Guide