Step 1
Audit senders
List workplace email, newsletters, forms, invoices, support tools and transactional providers.
1. Your domain
If an SPF record already exists, update it. Never publish a second one.
2. Email providers
Select every service that sends mail using this domain.
Separate multiple include domains with commas or spaces.
3. Your own servers
Redirect delegates the full policy and replaces the final all mechanism.
4. Failure policy
Start with ~all. Use -all only after every legitimate sender is included.
Publish SPF safely
Step 2
Publish one record
Merge every authorized source into one TXT record beginning with v=spf1.
Step 3
Test, then enforce
Begin with ~all, verify delivery and authentication, then consider moving to -all.
Frequently asked questions
What is an SPF record?
An SPF record is a DNS TXT record that lists the servers allowed to send email for your domain. Receiving mail systems compare the sending server with this policy to help detect spoofed messages.
Should I use ~all or -all?
Use ~all while discovering and testing every legitimate sender. Move to -all after confirming your website, workplace email, newsletters, support system and transaction providers are all authorized.
Can a domain have more than one SPF record?
No. A domain must have only one TXT record beginning with v=spf1. If one already exists, merge new senders into it rather than publishing a second SPF record.
What is the SPF 10 lookup limit?
An SPF evaluation may perform no more than 10 DNS lookups. Include, a, mx and redirect can consume lookups, and provider include records can contain additional nested lookups.
Where do I publish my SPF record?
Create or update a TXT record at the root of your domain in your DNS provider. The host is usually @, your domain name or left blank, depending on the provider.
Complete your email setup
Need a memorable address for your next email brand? Browse our premium domains — every name is $1,000 with instant transfer.