How to set up an SPF record for your domain

With SPF (Sender Policy Framework), you specify in DNS which servers may send email on behalf of your domain. Receiving mail servers use it to recognize forged senders.

Check your website now

How an SPF record is structured

An SPF record is a TXT record on your domain that starts with v=spf1. It's followed by the allowed senders, and the record ends with a rule for all other servers.

include:…: allow the servers of an email provider, for example include:_spf.google.com.
ip4:… and ip6:…: allow a specific IP address.
mx and a: allow the servers in your MX or A record.
-all rejects all other senders; ~all marks them as suspicious. Both are fine.
?all (neutral) and +all (allow everyone) offer no protection.

Example

If you use several services that send email on behalf of your domain (for example your email provider and a newsletter service), put them all in one record.

TXT record on example.com

v=spf1 include:_spf.google.com include:mailgun.org ~all

Domain without email

Does your domain send no email at all? Then add this record. It tells receivers that any email "from" your domain is forged.

TXT record for a domain without email

v=spf1 -all

What SPF does and doesn't do

SPF checks the technical sender address (the envelope sender or Return-Path), not the From address the recipient sees in their email program. A scammer can therefore put their own domain in the envelope and your domain as the visible sender. Only DMARC ties the two together.

SPF also often fails for forwarded email, because the forwarding server isn't in your record. A good SPF record improves the chance that your email arrives properly, but doesn't guarantee delivery to the inbox.

Common mistakes

Two SPF records on the same domain. That's invalid; merge them into one record.
Forgetting to add a new email provider or newsletter service.
More than ten DNS lookups (every include counts, as do the includes inside it). Above that, the record is invalid.
Ending with +all, which lets anyone send email on behalf of your domain.
"Fixing" a delivery problem by replacing -all with ?all or +all. Add the missing service to the record instead.

How SteadyHost rates SPF

OK: one SPF record that ends in -all or ~all.
Warning: no SPF record, or a record with ?all or +all.
Problem: multiple SPF records, or a record that needs more than ten DNS lookups.
SteadyHost counts the lookups of your record and of every include in it. If one of those lookups fails, we judge the record without the count.

Check your own website

A free check shows within seconds how your website is doing: availability, HTTPS and TLS, the SSL certificate, security headers, DNS and DNSSEC, domain registration and email security.