SPF Record: What It Is and How to Add or Fix One

What is an SPF record and how does it work?

SPF stands for Sender Policy Framework, a form of email authentication. The SPF TXT record is plain text in your DNS zone, and RFC 7208 from the IETF says TXT is the only record type to use. The old dedicated SPF type (99) is retired.

A receiving server accepts a message over SMTP, looks up the TXT record for the domain in the MAIL FROM address, and compares the connecting IP address with the authorized mail servers listed there.

The result is pass, fail, softfail, neutral, none (no record found) or an error. A permerror means the record itself is broken, while a temperror is usually a temporary DNS failure.

SPF checks the envelope sender, the Return-Path, and not the From header your reader sees, which is why it is paired with DKIM and DMARC. DKIM signs each message with a key whose public half sits in DNS. DMARC checks that the visible From domain lines up with a passing SPF or DKIM result, and tells receivers what to do when it does not. Publishing a record sends nothing and does not change how your website loads.

Where the record lives in DNS

It sits at the root of the domain, shown as @ in most panels, with a value starting v=spf1. Each subdomain that sends mail needs its own record, because the root record does not cover it.

What a receiving server does with it

The receiver reads the terms from left to right and stops at the first match. If nothing matches and no redirect applies, the result is neutral, so a record should always end with an all term.

Take a message claiming to be from your domain, sent from 198.51.100.7, with the record v=spf1 ip4:203.0.113.10 include:_spf.google.com ~all. That address does not match the ip4 term and is not in the ranges Google publishes, so the receiver reaches the ~all ending and returns softfail. The mail is flagged, not necessarily rejected.

Why a missing SPF record hurts your email and your domain

Start with domain spoofing. Without a record, a receiving server cannot tell your real mail server from a forger who puts your domain in a phishing message. That abuse can damage the domain's reputation and get it listed, which our domain blacklist guide helps you clean up.

Delivery is the second reason. Google's email sender guidelines say every sender needs SPF or DKIM, and bulk senders, more than 5,000 messages a day to Gmail accounts, need SPF, DKIM and DMARC. Both groups are told to keep the Postmaster Tools spam rate under 0.10 percent where you can, and never at or above 0.30 percent.

Google does not list SPF as a ranking factor, so this is an email trust item, not an SEO lever. It sits in the Server and Security group of our report because order emails that land in spam cost you customers.

How SEO Site Checker tests your SPF record

The result counts as one check in your score totals, and it never returns a warning.

The exact rule: pass means at least one TXT answer on the tested host starts with v=spf. We do not validate syntax, count lookups, detect multiple SPF records or judge the ending, so a record such as v=spf1 +all still passes.

What a pass and a fail mean here

Green means DNS answered with an SPF looking record for that host, nothing more. A line such as v=spf1 +all turns the check green while authorizing every server on the internet, and two SPF records both pass although receivers reject the pair. Whether your real mail authenticates is outside this test.

The match is also a case sensitive prefix test. A record typed as V=SPF1 fails here, although receivers accept it under RFC 7208, and a malformed start such as v=spf10 would still pass. If the mark stays red on a record you can clearly see, retype the start of it in lowercase as v=spf1 and save again.

Red means no record came back for the host you entered, so check its spelling before you edit DNS.

Edge cases that cause a surprise result

Typing www.example.com tests the www host only. When the record exists only on example.com, the report can show SPF record not found even though mail is fine, as we saw when google.com passed and www.google.com failed. Test the bare domain, or make www a CNAME to the root.

Records over 255 characters are stored as several strings. They still pass, though the badge can show stray quotes at each break.

How to check an SPF record on any domain

1. Use the free SPF record lookup. Enter the domain in our DNS Record Lookup and find the TXT row that starts with v=spf1. Our guide to finding DNS records for any domain covers other record types.
2. Use the command line. Run dig +short TXT yourdomain.com on Linux or macOS, or nslookup -type=TXT yourdomain.com on Windows. The quotes in the answer are display only.
3. Run the report. Read the Server and Security group, where a found record appears in a green badge.

Example output for a Google Workspace domain:

$ dig +short TXT yourdomain.com
"v=spf1 include:_spf.google.com ~all"

One line starting with v=spf1 is what you want to see. Two such lines mean a duplicate, so merge them even though our report would still pass it. No such line means the red result is correct for that host, and you should add a record.

How to add an SPF record to your DNS in five steps

1. List your sending sources. Write down every service that sends mail as your domain, such as the mailbox host, newsletter tool, store notifications and invoicing, and collect each include value from its help page. Our overview of email hosting providers includes a checklist for updating SPF when mailboxes move.
2. Build one string. Start with v=spf1, add your include and ip4 terms, and finish with ~all or -all.
3. Add the TXT record. The name servers in a WHOIS Lookup show where your DNS is hosted. Open that zone editor, add a TXT record for the root domain and paste the string as the value. Most panels add the quotes themselves.
4. Check for duplicates. Merge any old SPF record into the new string.
5. Wait, then verify. Google says a change can take up to 48 hours to start working. Check with dig, then re-run the report.

Type: TXT
Host: @
Value: v=spf1 include:_spf.google.com ~all

Cloudflare, GoDaddy and Namecheap accept @ for the root, while cPanel usually wants the full name with a trailing dot in its Name field.

SPF record examples you can copy and adapt

Each block is the TXT value to publish on the host @.

Google Workspace

Google uses the soft ending in its Google Workspace SPF setup guide.

v=spf1 include:_spf.google.com ~all

Microsoft 365

Microsoft recommends the hard fail ending once DKIM and DMARC are set, per its Microsoft 365 SPF guide.

v=spf1 include:spf.protection.outlook.com -all

Your own server plus a mailing tool

The address below is a documentation address, and ip4 terms cost no lookups. For the mailing tool, copy the include value from that service's own SPF help page and never guess it.

v=spf1 ip4:203.0.113.10 include:mail.example.net ~all

A domain that sends no email

This tells receivers that nothing may send from the domain. It covers only the host it sits on, so subdomains need their own v=spf1 -all, or a wildcard TXT record at *.example.com if your DNS host supports it. A wildcard skips any subdomain that has records of its own.

v=spf1 -all

Replace the example values with your own, and keep one record per host.

SPF record syntax: qualifiers, ~all vs -all and the 10 lookup limit

Terms are read left to right, and the first match decides the result. Most records start with v=spf1 and end with an all term, with your senders in between.

The ip4 and ip6 mechanisms authorize an address or CIDR range directly. To authorize a mailing service, use include, which pulls in the other domain's list. The a and mx mechanisms cover the servers behind your own A or MX records, and the redirect modifier hands the decision to another domain.

Qualifiers and the all term

Which ending? Google shows ~all and Microsoft recommends -all once DKIM and DMARC are in place. Use ~all while you audit senders, then -all.

The 10 lookup limit

An SPF check may trigger at most 10 DNS lookups. The include mechanism, the a mechanism, the mx mechanism, the ptr mechanism (avoid it, because RFC 7208 says it should not be published), the exists mechanism and the redirect modifier each count, while ip4, ip6 and the all mechanism cost nothing. Nested includes count too, and RFC 7208 recommends limiting void lookups, which return nothing, to two. The RFC 7208 lookup limits give the exact rule.

Going over the limit gives a permerror (too many DNS lookups), as can the void limit. To cut the count, remove unused services or swap includes for ip4 terms, known as SPF record flattening. It has a cost: when a vendor changes its IP ranges, your copied addresses go stale and its mail fails. RFC 7208 also advises keeping the whole DNS answer under 512 octets.

Common SPF record mistakes and how to fix them

Two records on one host: Receivers that follow RFC 7208 return a permerror when a host has more than one SPF record, so mail can fail although each looks fine alone. Merge them into a single string, and add each new sender to that record instead of publishing another.

• The wrong host. People often edit one host and run the report against the other, so a correct record looks missing. Test the host you changed.
• Invalid SPF syntax. Typical slips are include= instead of include:, a trailing dot after an include domain, a space after the colon, or quotes typed into a panel that adds them. Microsoft lists the first three of these as common errors, so write include:domain.com exactly.
• The wrong ending. A record that finishes with +all authorizes everyone, and one with no all term at all yields a neutral result. Replace +all with ~all or -all, and put an all term last.
• A forgotten sender. If the newsletter tool is missing from the record, its mail starts landing in the spam folder. Add its include to your record.
• A CNAME beside TXT. DNS does not allow a CNAME and a TXT record on the same name. Move the mail records to a subdomain.
• Forwarding surprises. SPF breaks with email forwarding, because the forwarding server is not on your list. DKIM usually survives a forward, so large senders publish it as well, along with DMARC.