iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To add an SPF record, publish a single TXT record in your domain’s DNS that authorizes every service sending email for that domain. First check for an existing SPF record, identify all legitimate senders, build one policy using their current instructions, then verify SPF in a received message’s authentication headers. Adding a second SPF record or leaving out a website or third-party sender can cause legitimate mail to fail.
What an SPF record does—and what it does not do
Sender Policy Framework (SPF) is a DNS-published policy that tells receiving mail systems which hosts are authorized to send using a domain in the relevant SMTP identity. RFC 7208 defines SPF checks against the SMTP MAIL FROM and HELO identities; SPF does not directly verify every address a recipient sees in the message’s From line. RFC 7208
SPF can help receiving systems assess outgoing mail, but it is not a guarantee that messages will reach the inbox or a complete defense against spoofing. Google recommends configuring SPF alongside DKIM and DMARC. Its Gmail sender guidance says all senders to Gmail accounts must use SPF or DKIM, and senders sending more than 5,000 messages per day must use SPF, DKIM, and DMARC. These are Google’s published requirements; check its current guidance when configuring mail for Gmail recipients. Google’s Gmail sender guidelines
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Before you add or change SPF
Check whether an SPF record already exists
Look up the domain’s existing DNS TXT records and find any value beginning with v=spf1. If one exists, update it to include the necessary senders rather than publishing another SPF record. Google’s setup instructions describe adding or updating the TXT record to reflect the domain’s senders. Google Workspace: Set up SPF
#1 Best Overall
Make a complete list of systems that send mail
Ask whoever manages your email, website, and business applications which systems send messages using your domain. Consider mailboxes, website contact forms, web or on-premises mail servers, outbound gateways, and third-party email services. A service can send mail even if it does not provide your staff’s inboxes. Record each sender’s current SPF instructions; the final policy must account for all legitimate senders. Google’s setup guide lists these kinds of senders and provider examples. Google Workspace: Set up SPF
- Mail suite or hosted mail server
- Website, contact form, or application that sends automated messages
- Outbound gateway or on-premises server
- Marketing, customer-support, or other third-party mail service
How to add an SPF record
- Open your domain’s DNS settings. Sign in to the company that hosts your DNS—often the domain registrar or DNS provider—and open its DNS-record management screen. Labels and field names differ by provider.
- Add or edit a TXT record. Set the record type to
TXT. Enter the domain or host/name requested by the DNS interface; some providers represent the root domain with a blank field or a special value. Follow that provider’s instructions rather than assuming the field format. Some providers require quotation marks around the value. Google Workspace: Set up SPF - Enter one policy covering your senders. The value starts with
v=spf1, followed by the mechanisms or provider-specific includes that authorize your actual mail sources. Use the exact SPF instructions from each service you use; there is no universal value that safely covers every domain. - Save the DNS change. If a subdomain sends mail, configure SPF for that subdomain as well. A policy on the root domain does not automatically cover sending subdomains. Google Workspace: Set up SPF
Example: Google Workspace only
For a domain whose only sender is Google Workspace, Google documents this example value:
v=spf1 include:_spf.google.com ~all
This is not a general-purpose record. Do not use it unchanged if another server, website, or service also sends mail for the domain. Google recommends ~all in its setup instructions; follow the current guidance for your configuration. Google Workspace: Set up SPF
Keep the policy within SPF’s DNS lookup limit
SPF has a limit of 10 DNS lookups. Mechanisms such as a, mx, include, and ptr can trigger lookups, including through the policies they reference. Exceeding the limit can prevent messages from passing SPF. Check the complete policy and its included records rather than counting only the terms visible in your TXT value. Google Workspace: Troubleshoot SPF issues
Verify that SPF is working
- Allow time for the change. Google says SPF can take up to 48 hours to start working after a record is added. This is Google’s estimate, not a guarantee that every DNS provider or recipient will update on the same schedule. Google Workspace: Set up SPF
- Send a test message. Send from an account or service covered by the policy to a mailbox you can inspect.
- Inspect the full message headers. Find the
Authentication-Resultsheader and check the SPF result. Google recommends reviewing this entry when diagnosing whether SPF is set up correctly. Google Workspace: Troubleshoot SPF issues - Test other legitimate senders. A pass from one mail service does not establish that a website form or another third-party sender is covered. Check messages from each system that uses the domain.
Why an SPF check can fail
| Symptom | What to check |
|---|---|
| A legitimate message fails SPF | Confirm the sending service—including a website form or third-party provider—is included in the policy, and check the service’s current configuration instructions. Google Workspace troubleshooting |
| No SPF result appears | Check that the TXT record is present and configured correctly, then inspect the full message’s Authentication-Results header. Google Workspace troubleshooting |
| Messages fail after adding senders | Review the policy’s total DNS lookups. SPF allows up to 10; terms such as a, mx, include, and ptr can contribute. Google Workspace troubleshooting |
| Mail from a subdomain fails | Publish an SPF policy for that sending subdomain; the root-domain record does not automatically cover it. Google Workspace: Set up SPF |
| A provider still reports setup as pending | Allow for DNS propagation and processing time. Google gives an estimate of up to 48 hours for SPF authentication to start working. Google Workspace: Set up SPF |
Maintain SPF as your email setup changes
Revisit the record whenever you add or remove a mail server, website sender, gateway, or third-party service. Add new legitimate senders using their current published instructions, and remove authorization for services you no longer use. Keep the list of actual senders with whoever owns domain DNS so routine service changes do not silently leave the policy incomplete.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
