What is an SPF record and how do I add one?

SPF is a DNS TXT record that lists the servers allowed to send email for your domain. Without one, a receiver has no way to tell your real mail from a message that merely claims to come from you, so forged mail is judged on its contents alone.

Why this matters

SPF stands for Sender Policy Framework and is defined in RFC 7208. It is stored as a single TXT record at your domain, beginning with v=spf1, followed by mechanisms that describe who may send mail and a qualifier that says what to do with everyone else. The RFC’s own example is v=spf1 +mx a:colo.example.com/28 -all. Mechanisms such as a, mx, ip4, ip6, include, and exists each match a set of sending hosts, and each carries a qualifier: + means pass, - means fail, ~ means soft fail, and ? means neutral. The trailing -all is the common ending and marks any server not matched as a hard fail. Receivers map all of this to results such as Pass, Fail, SoftFail, Neutral, None, and temporary or permanent errors. One connected detail matters when you write the record: SPF allows at most ten terms that cause a DNS lookup, so stacking up include mechanisms can push a record over the limit and break it, with no obvious error until mail starts failing. Because there are no SPF checks in a browser, this is pure DNS and has nothing to do with the page your users load.

How to fix it

Publish exactly one SPF TXT record at your domain. Begin with v=spf1, add an include or an address mechanism for each service that sends mail on your behalf, and end with -all once the list is complete. Use ~all only while you are still discovering your senders, since it soft-fails rather than rejects. Keep the number of DNS-querying mechanisms under the limit of ten, and never publish two SPF records at the same name, because a duplicate makes the record invalid and receivers cannot evaluate it.

# One SPF record: allow Google Workspace and your own mail host, fail the rest
example.com  TXT  "v=spf1 include:_spf.google.com include:mail.example.com -all"

How to verify the fix

Query the TXT records for your domain and confirm there is a single v=spf1 record, that it contains the mechanisms you expect, and that it ends in -all. Use nslookup on Windows or dig elsewhere; the public answer you get back is exactly what a receiving mail server sees when it decides whether to trust a sender.

nslookup -type=TXT example.com
# or, where available:
dig +short TXT example.com

Related issues