SPF Setup Guide
Learn how to configure SPF records to authorize legitimate email senders and prevent spoofing.
What is SPF?
SPF (Sender Policy Framework) is a DNS-based email authentication method that allows domain owners to specify which mail servers are authorized to send email on behalf of their domain. When an email is received, the receiving server checks the SPF record to verify that the sending server is authorized.
SPF Record Syntax
An SPF record is a TXT record published at your domain. Here is an example of a complete SPF record:
v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.10 -all| Mechanism | Description | Example |
|---|---|---|
| ip4 | Authorize IPv4 addresses | ip4:203.0.113.10 |
| ip6 | Authorize IPv6 addresses | ip6:2001:db8::1 |
| a | Authorize domain's A record IPs | a:mail.example.com |
| mx | Authorize domain's MX record IPs | mx |
| include | Include another domain's SPF | include:_spf.google.com |
| all | Match all (used at end) | -all |
SPF Qualifiers
Each mechanism can be prefixed with a qualifier that determines what action to take when matched:
+Pass
Allow the email (default if no qualifier)
-Fail
Reject the email (hard fail)
~SoftFail
Accept but mark as suspicious
?Neutral
No assertion about authorization
Common Email Providers
Here are the SPF include statements for popular email providers:
| Provider | SPF Include |
|---|---|
Google Workspace | include:_spf.google.com |
Microsoft 365 | include:spf.protection.outlook.com |
Amazon SES | include:amazonses.com |
Mailchimp | include:servers.mcsv.net |
SendGrid | include:sendgrid.net |
Mailgun | include:mailgun.org |
Step-by-Step Setup
Identify all sending sources
List all services that send email on your behalf (your mail server, marketing tools, CRM, etc.).
Gather SPF includes
Get the SPF include statement from each provider. Check their documentation or support.
Build your SPF record
Combine all includes into a single record starting with v=spf1 and ending with -all.
Publish to DNS
Add the TXT record at the domain that appears in the envelope sender (usually your root domain). Subdomains that send mail need their own SPF record — a parent record does not cover them.
Test and verify
Use SPF validation tools to verify your record is correct and all senders are authorized.
SPF Lookup Limit
SPF records are limited to 10 DNS lookups. Each include, a, mx, and redirect mechanism counts as one lookup. Nested includes also count toward this limit.
- Use
ip4andip6when possible (no lookup required) - Flatten the record if you are over the limit — see below
Hosted SPF flattening
If your record is at or over the 10-lookup limit, DDMARC can host it for you. Open your domain, go to the Hosted Services tab and configure the SPF flattening card with your sending sources. DDMARC resolves those includes on your behalf, keeps the resolved IP ranges up to date as providers change them, and serves the result from its own zone — so your published record collapses to a single include.
v=spf1 include:example.com.spf.dmarc.ddmarc.com ~allReplace example.com with your own domain. The exact value is shown on the card — copy it from there.
DDMARC also counts your SPF lookups on every DNS check and flags an overflow in the domain's DNS health score, so you find out before receivers start returning permerror.
Best Practices
- Roll out with
~all(softfail) while you are still finding senders, then tighten to-allonce your DMARC reports show the list is complete - Have only one SPF record per domain (multiple records will fail)
- Keep each TXT string under 255 characters — longer records are legal but must be split into multiple quoted strings, which some DNS editors get wrong
- Review and update your SPF record when adding new email services