An SPF record is a line of text in your DNS listing the servers allowed to send email for your domain. Receiving servers check it to see whether a message came from an approved source.
What one looks like
v=spf1 include:_spf.example-mail.com ~allv=spf1says this is an SPF record.include:approves everything another domain lists.~allsays to treat anything else with suspicion.
The ending matters
| Ending | Meaning |
|---|---|
-all | Fail anything not listed |
~all | Soft fail: accept but mark as suspicious |
?all | No opinion |
How to add a sending tool
Add its include: to your existing record. Don't create a second one.
v=spf1 include:_spf.example-mail.com include:_spf.example-crm.com ~allTwo mistakes that break SPF
- Two SPF records. A domain must have only one. Merge them.
- Too many lookups. Evaluating SPF can't take more than 10 DNS lookups. Each
includecounts, along with whatever is inside it.
What SPF doesn't do
SPF can break when mail is forwarded, which is why DKIM matters too. It also says nothing about whether recipients want your mail, so passing SPF doesn't mean you'll reach the inbox.
Do you need it?
Google requires everyone sending to personal Gmail accounts to have SPF or DKIM, and senders of more than 5,000 messages a day to have both, plus DMARC. You can read your records with our free SPF checker. It reads DNS only, so it can't tell you where your mail lands.