How to add an SPF record
- Above, tick every service that sends email for your domain: your mail provider, your website's contact form, your billing or CRM system, your newsletter tool.
- Copy the generated record.
- In your DNS panel, add it as a new TXT record on the domain itself (host
@or blank). - If there's already a
v=spf1record, don't add a second one. Replace the old one with this record. - After a few minutes, verify it with the SPF, DKIM & DMARC check.
Rules for a valid SPF record
| Rule | Explanation |
|---|---|
| One record only | A domain may have just one v=spf1 record. Two records make SPF fail outright (permerror). |
| At most 10 DNS lookups | include, a, mx, redirect and exists each count as a lookup, including nested includes. Go over 10 and SPF fails. |
~all or -all | ~all marks unlisted senders as suspicious; -all rejects them outright. Use -all if you're sure of all your sources; otherwise start with ~all. Never use +all. |
| Remove what you don't use | Delete includes for services you no longer use. They waste lookups and authorize senders you don't need. |
Ready-made examples
- Google Workspace only:
v=spf1 include:_spf.google.com ~all - Microsoft 365 only:
v=spf1 include:spf.protection.outlook.com -all - Zoho Mail only:
v=spf1 include:zoho.com ~all - Your own server plus Google:
v=spf1 ip4:SERVER_IP include:_spf.google.com ~all
SPF alone isn't enough. Add a DKIM signature and a DMARC policy as well. SPF, DKIM and DMARC explained covers why.
Frequently asked questions
Where do I add the SPF record?
Wherever your domain's DNS is managed: usually your domain registrar, your hosting control panel (cPanel, Plesk) or Cloudflare. The record type is TXT, the host is @ (or blank), and the value is the line you generated.
My emails still go to spam. Is my SPF wrong?
Even with a correct SPF record, mail can land in spam if DKIM or DMARC is missing, your IP is on a blacklist, or the content looks spammy. Our guide on why emails go to spam has a step-by-step checklist.
How long until SPF takes effect?
Anywhere from a few minutes to a few hours, depending on your DNS TTL.
Related: Why emails go to spam · SMTP error codes (including SPF failures) · Email blacklist check