SPF Record Basics: Authorize Your Mail Servers
SPF (Sender Policy Framework) tells email receivers which servers are authorized to send email for your domain. Learn how SPF works, basic syntax, and how to create your first SPF record.
SPF in Simple Terms
SPF is a whitelist of authorized mail servers for your domain. It's a DNS record that says "only these IP addresses can send email as @yourdomain.com".
Bottom Line: SPF prevents spammers from forging your domain by listing approved senders.
How SPF Works
Email Sent
Someone sends an email claiming to be from you@yourdomain.com from IP address 192.0.2.100
SPF Lookup
Receiving server checks DNS for your SPF record at yourdomain.com
Verification
If 192.0.2.100 is in your SPF record → ✓ SPF pass (authorized)
If not in your SPF record → ✗ SPF fail (unauthorized)
SPF Record Syntax
Basic Structure
v=spf1 ip4:192.0.2.0 include:_spf.google.com ~allv=spf1
SPF version (always v=spf1)
ip4:192.0.2.0
Authorize specific IPv4 address
include:_spf.google.com
Include another domain's SPF record (for Google Workspace)
~all
Soft fail for everything else (recommended for testing)
Common Mechanisms
ip4:192.0.2.0/24Authorize IPv4 address or range
ip6:2001:db8::1Authorize IPv6 address
include:_spf.example.comInclude another SPF record (for ESPs)
mxAuthorize servers in MX records
aAuthorize domain's A record IP
Qualifiers (All Tag)
~all (SoftFail)Recommended for testing - accept but mark as suspicious
-all (Fail)Recommended for production - reject unauthorized senders
?all (Neutral)No policy - not recommended
+all (Pass)Allow all - NEVER use this!
Real-World Examples
Google Workspace Only
v=spf1 include:_spf.google.com ~allFor companies using only Google Workspace for email
Microsoft 365 + Marketing Platform
v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net ~allMicrosoft 365 + Mailchimp email sending
Multiple Services + Own Server
v=spf1 ip4:192.0.2.0 include:_spf.google.com include:sendgrid.net -allOwn mail server + Google Workspace + SendGrid with strict policy
Important Limits
include: counts as one lookup. Exceeding this causes SPF PermError and authentication failure. Use SPF Surveyor to check your lookup count.