The basics
What a SPF record does
SPF (Sender Policy Framework) is a TXT record on your domain that lists the servers allowed to send email for it. When a mail server receives a message, it looks up the SPF record of the sending domain and checks whether the server that delivered the message is on the list.
SPF checks the hidden envelope sender (the Return-Path), not the From address people see. That is why SPF alone does not stop spoofing: a scammer can pass SPF with their own domain and still show your name in From. DMARC closes that gap by requiring SPF or DKIM to match the visible From domain.
Example record · TXT at example.com
v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all
Google Workspace and Microsoft 365 may send for this domain, and everything else should fail. A domain that never sends email should publish just v=spf1 -all.
Reading the result
What each part of the record means
| You see | It means |
|---|---|
| v=spf1 | Marks the TXT record as SPF. It must come first. |
| include: | Trusts another domain's SPF list, usually your email provider or a sending service. |
| ip4: / ip6: | Allows a specific server address or range. |
| a / mx | Allows the servers your domain's A or MX records point to. |
| -all | Hard fail: anything not listed should be rejected. The strongest ending. |
| ~all | Soft fail: anything not listed is suspicious. Common while you finish setting up. |
| ?all | Neutral: SPF says nothing either way. Offers no protection. |
| +all | Anyone may send as your domain. Never use this. |
Common problems
SPF mistakes we see most
Two SPF records
A domain may only have one TXT record starting with v=spf1. Two records make SPF fail with a permanent error. Merge them into one.
More than 10 DNS lookups
Each include, a, mx, ptr, exists and redirect costs a lookup, and nested includes count too. Past 10, SPF fails for every message. Remove services you no longer use or ask a provider for a flatter include.
Ending in ?all or +all
These tell receivers not to act on SPF at all, or to trust everyone. Use ~all while you check every sender, then -all.
A sending service left out
Invoicing tools, CRMs and newsletter platforms often send as your domain. If they are missing, their mail fails SPF once DMARC is enforced.
Fixing it
How to fix your SPF record
- List every service that sends email using your domain: your mailbox provider, website forms, invoicing, CRM, helpdesk and newsletter tools.
- Find each service's SPF include in its documentation, for example include:_spf.google.com for Google Workspace or include:spf.protection.outlook.com for Microsoft 365.
- Publish one TXT record at your domain root that starts with v=spf1, lists those includes, and ends with ~all.
- Run this check again. Once DMARC reports show all your real mail passing, change ~all to -all.
Questions
SPF FAQ
What is an SPF record?
A TXT record on your domain, starting with v=spf1, that lists the servers allowed to send email for that domain. Receiving mail servers use it to spot mail from servers you did not authorize.
Should my SPF record end in -all or ~all?
End in -all once you are sure every legitimate sender is listed. Use ~all while you are still finding senders. With DMARC enforced, both work, because DMARC makes the final decision.
What does 'too many DNS lookups' mean?
SPF allows at most 10 DNS lookups while it is evaluated, counting nested includes. Above that the result is a permanent error and SPF fails for all of your mail. Remove unused includes to get back under the limit.
Does SPF stop spoofing on its own?
No. SPF checks the hidden envelope sender, not the From address people see. You need DMARC set to quarantine or reject to stop fake email showing your domain in From.
More free checks
Checking domains for clients?
Inside Scan Hub the same check runs per client and produces a white-label PDF with the evidence behind every answer. Check again after the fix and the report shows the grade before and after.