Inboxpass All guides

Guides

How to create an SPF record

23 October 2026

An SPF record is one TXT record on your domain that lists the servers allowed to send mail for it. It starts with v=spf1, has one include (or IP address) for each service that sends for you, and ends with ~all or -all. You publish it at your DNS host, at the root of the domain. Most domains need one line, and the work is finding everything that sends.

What a finished record looks like

Google Workspace’s SPF setup page gives this record for a domain that only sends through Google:

v=spf1 include:_spf.google.com ~all

Microsoft’s SPF article gives this one for a domain that only sends through Microsoft 365:

v=spf1 include:spf.protection.outlook.com -all

Read left to right. v=spf1 marks it as SPF. Each mechanism in the middle describes allowed senders. The last term says what happens to everyone else. RFC 7208 section 4.6.2 says receivers check the terms from left to right and stop at the first match.

Step 1: List everything that sends as your domain

SPF checks the domain in the envelope sender, also called MAIL FROM or the return path. A service needs to be in your record when it sends with your domain in that slot. Start a list:

Some services send with their own domain in the envelope sender and sign with DKIM on yours. Those do not need an SPF include from you, and their docs will say so. Check each provider’s authentication page rather than guessing. If you already have a DMARC record with rua, the aggregate reports list every IP that sent as you. Our guide to reading DMARC reports covers how.

Step 2: Get each service’s include

Each provider publishes the mechanism to add, almost always an include:. Google’s examples combine its include with others:

v=spf1 include:_spf.google.com include:amazonses.com ~all
v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

Copy the exact value from your provider’s help page or account settings. Some providers give a different include per account or per region. Microsoft, for example, uses spf.protection.office365.us for GCC High and DoD tenants instead of the commercial one.

For your own servers, use the IP addresses:

ip4:203.0.113.25
ip4:198.51.100.0/24
ip6:2001:db8::/32

Section 5.6 of the RFC says the prefix length is optional, defaulting to a single address, and that you cannot shorten an address by dropping parts of it. Use CIDR notation for a range.

Step 3: Pick the ending

If you are still finding senders, start with ~all. A forgotten service then gets a weak signal instead of a hard fail. Once DMARC reports confirm your list is complete, you can move to -all. Both endings fail DMARC equally for an unlisted server, because DMARC only counts an SPF pass.

Step 4: Assemble one record

Put the pieces together in one line, version first and all last:

v=spf1 include:_spf.google.com include:sendgrid.example ip4:203.0.113.25 ~all

(The middle include is a placeholder. Use your provider’s real value.)

Rules that matter here:

Step 5: Publish it

At your DNS host (often your domain registrar, or Cloudflare), add or edit a TXT record:

Google says SPF can take up to 48 hours to start working after you publish it.

Step 6: Check it

Look up the record from the command line:

dig TXT example.com +short
nslookup -type=TXT example.com

You should see exactly one string starting with v=spf1. Other TXT records at the same name, such as site verification codes, are fine.

Then send a real message from each service to a Gmail account you control. Open it, choose More, then Show original, and look at the SPF line. You want spf=pass with your domain, or the service’s own bounce domain if it sends that way and relies on DKIM.

Subdomains and domains that never send

An SPF record covers only the exact name it sits on. Microsoft and Google both say each subdomain that sends mail needs its own SPF record. If your newsletter goes out as news.example.com in the envelope sender, publish a record at news too. Microsoft suggests putting third-party bulk mail on a subdomain partly so the main domain stays under the lookup limit.

For a domain that sends no mail at all, publish a record that authorizes nobody. Microsoft’s parked-domain example:

v=spf1 -all

That tells receivers any mail claiming to come from it is not authorized. Pair it with a DMARC record at p=reject, as covered in our guide to DMARC policies.

SPF alone is not enough

SPF checks the envelope sender, which recipients never see. It breaks when mail is forwarded, because the forwarding server is not in your record. That is why Gmail and Yahoo also want DKIM, and why bulk senders need DMARC on top. See the Google and Yahoo sender requirements for the full list. Microsoft’s SPF article ends on the same point: configure DKIM and DMARC as well.

Keeping it current

An SPF record is not a one-time job. It drifts as you add and drop tools.

Sources