What is an SPF Record?
SPF (Sender Policy Framework) is an email authentication protocol that helps prevent email spoofing. It tells receiving mail servers which IP addresses are authorized to send email for your domain.
How SPF Works
When you send an email, the receiving server checks your domain's SPF record to verify that the sending server is authorized. Here's the process:
- Email is sent from your mail server to the recipient
- Receiving server extracts the domain from the envelope sender (Return-Path)
- DNS lookup retrieves the SPF record for that domain
- IP comparison checks if the sending IP matches the authorized list
- Result is pass, fail, softfail, or neutral
Example SPF Record
v=spf1 include:_spf.google.com include:sendgrid.net ip4:192.0.2.1 -all
This record authorizes Google Workspace, SendGrid, and a specific IP address to send email for the domain.
SPF Record Syntax Explained
An SPF record consists of several parts:
| Mechanism | Description | Example |
|---|---|---|
| v=spf1 | Version identifier (required) | v=spf1 |
| include: | Include another domain's SPF | include:_spf.google.com |
| ip4: | Authorize an IPv4 address/range | ip4:192.0.2.0/24 |
| ip6: | Authorize an IPv6 address/range | ip6:2001:db8::/32 |
| a | Authorize the domain's A record IP | a |
| mx | Authorize the domain's MX servers | mx |
| -all | Hard fail (reject unauthorized) | -all |
| ~all | Soft fail (accept but mark) | ~all |
Common SPF Mistakes to Avoid
Too Many DNS Lookups
SPF has a 10 DNS lookup limit. Each include:, a, mx, and redirect counts as a lookup. Exceeding this causes SPF to fail.
Using +all
Never use +all as it authorizes anyone to send email as your domain. Always use -all (hard fail) or ~all (soft fail).
Multiple SPF Records
You can only have ONE SPF record per domain. Multiple records cause SPF to fail. Combine all mechanisms into a single record.
Forgetting Third-Party Senders
If you use services like Mailchimp, SendGrid, or HubSpot, you must include their SPF records or your marketing emails will fail.
SPF and Email Deliverability
SPF is one of three key email authentication protocols, alongside DMARC and DKIM. Together, they form the foundation of email security and are now required by Google and Yahoo for bulk senders.
Without proper SPF configuration, your emails may:
- Land in spam folders
- Be rejected entirely by receiving servers
- Be flagged as potential phishing attempts
- Damage your domain's sender reputation
Check Your SPF Record Now
Use our free SPF checker to validate your record, check DNS lookups, and get copy-ready fixes for any issues.
Free SPF Checker →