SPF Record Guide: Publish, Align, and Avoid Lookup Limits

An SPF record is a DNS TXT record that lists the mail servers allowed to send email for your domain. Receiving servers check that list when a message arrives. If the sending IP is not authorised, SPF fails and DMARC can quarantine or reject the mail.

This guide focuses on SPF alone: syntax, common includes, the ten-lookup limit, and how to verify the record with a DMARC checker that also surfaces SPF and DKIM in one DNS health pass. For the full trio, see SPF, DKIM and DMARC explained.

Where SPF lives in DNS

Publish a TXT record on the apex (or the exact domain that appears in the SMTP mail-from / bounce domain). You should have one SPF policy per domain. Multiple SPF TXT records cause unpredictable failures.

v=spf1 include:_spf.google.com include:sendgrid.net -all

• `v=spf1` - required version tag; always first.
• `include:` - pull another provider's authorised IPs by DNS.
• `ip4:` / `ip6:` - authorise specific addresses when you run your own MTA.
• `-all` - hard fail for anything not listed (preferred once inventory is complete).
• `~all` - soft fail; useful briefly during migration, not as a permanent setting.

Build an inventory before you publish

1. 1List every system that sends as your domain: Google Workspace, Microsoft 365, CRMs, billing, support desks, marketing tools.
2. 2Copy each provider's recommended SPF include or IP mechanism from their docs.
3. 3Merge into a single v=spf1 ... -all string.
4. 4Count DNS lookups (each include, a, mx, and redirect counts toward the limit of ten).
5. 5Publish, send test mail, then confirm SPF pass in message headers.

Alignment with DMARC

SPF can pass for the bounce domain while the visible From domain differs. DMARC requires alignment: the authenticated domain must match (or be a parent of) the From domain, depending on aspf strict or relaxed mode. See DMARC policy explained before you tighten p=quarantine or p=reject.

Common SPF mistakes

• Publishing two SPF TXT records instead of one combined policy.
• Leaving `+all` or a missing all mechanism, which authorises the world.
• Forgetting a transactional ESP so invoices start failing after DMARC enforcement.
• Using `~all` forever so spoofed mail still reaches inboxes.

How to verify SPF is working

Run the free DMARC checker or a full DNS health scan against your domain. PatchPings reports whether an SPF record exists and whether the value looks parseable alongside DKIM and DMARC. Pair that with a real outbound test and inspect Received-SPF in the destination inbox.

SPF is the allow-list. DKIM is the signature. DMARC is the policy. Get SPF complete and under the lookup limit first, then move on to the DKIM record guide so enforcement does not surprise a forgotten sender.