What Is an SPF Record?
An SPF record is a DNS TXT record that lists the servers and services allowed to send mail using your domain in the envelope sender address. Receiving servers compare the connecting IP address with that list and return a result such as pass, fail or softfail.
Where to Add an SPF Record
Add the record at the domain used in the envelope sender, often the root domain, in the DNS service that is authoritative for it. A subdomain that sends mail needs its own SPF record, because SPF records are not inherited. Your registrar and your DNS host can be different companies, so check which one runs your nameservers.
SPF Record Syntax
Every SPF record starts with v=spf1, continues with mechanisms that match senders and ends with an all mechanism for everyone else. A qualifier before a mechanism sets its result: + for pass (the default), - for fail, ~ for softfail and ? for neutral.
SPF Record Example
The record v=spf1 ip4:192.0.2.10 include:_spf.example.net -all authorizes one IPv4 address and the servers in another domain’s SPF policy. Every other sender receives a fail result. Replace the address and include with the values your own providers publish, never with values copied from another organization.
SPF Include vs Redirect
An include mechanism evaluates another domain’s SPF policy and matches when that policy passes. A redirect modifier hands the whole evaluation to another domain when no mechanism in the current record matches. Because an all mechanism always matches, a redirect in the same record is never reached.
| Mechanism | Purpose | Counts toward lookup limit |
|---|---|---|
| ip4 / ip6 | Authorize an address range | No |
| include | Evaluate another SPF policy | Yes |
| a / mx | Match address or mail-exchanger addresses | Yes |
| all | Match all remaining senders | No |
| redirect | Delegate remaining evaluation | Yes |
SPF Record With Multiple Includes
Combine every sending service into one record with one include or address mechanism per provider, such as v=spf1 include:_spf.example.net include:mail.example.org ~all. Collect each provider’s current instructions first, from your mailbox host, newsletter service and transactional sender.
More Than One SPF Record
Two TXT records that start with v=spf1 at the same name cause a permanent error, so receivers treat SPF as broken. When you add a provider, edit the existing record instead of creating a second one. Remove includes for services you no longer use, because each one still counts toward the lookup limit.
SPF Lookup Limit
SPF allows at most ten DNS-querying terms per evaluation, and going over the limit returns a permanent error. Includes nested inside other includes count toward the same total.
SPF Record Lookup Count
The include, a, mx, ptr and exists mechanisms and the redirect modifier each use one of the ten lookups. The ip4, ip6 and all mechanisms do not query DNS and cost nothing. Near the limit, remove unused providers or replace an a or mx mechanism with the addresses it resolves to, if those addresses rarely change.
How to Test an SPF Record
After you publish, check the record with an SPF checker and send a test message to a mailbox you control. Allow for the record’s TTL before you expect every resolver to return the new value.
SPF Softfail vs Hardfail
Softfail (~all) asks receivers to accept failing mail but treat it with suspicion, while hardfail (-all) states that failing senders are not authorized. When a domain publishes DMARC, many receivers base the final decision on the DMARC result rather than on SPF alone. Choose -all only after every legitimate sender passes.
SPF Record and DMARC
SPF checks the envelope sender domain, which readers usually do not see. DMARC only counts an SPF pass when that domain aligns with the visible From domain. Read the Authentication-Results header of a received message to confirm both results.
Frequently Asked Questions
Can You Have More Than One SPF Record?
No. A domain name must have only one SPF record, and two or more cause a permanent error. Merge the mechanisms from all providers into a single v=spf1 record.
How Long Does an SPF Record Take to Update?
Most DNS providers publish a change within minutes. Resolvers that cached the old record keep using it until its TTL, a value in seconds, runs out. Check from more than one network before you assume the change failed.
Does an SPF Record Need Quotes?
Zone files write TXT values in double quotes, and many DNS dashboards add them for you. The quotes are not part of the SPF value itself. A record longer than 255 characters is stored as several quoted strings that receivers join without spaces.
Do SPF Records Apply to Subdomains?
No. SPF is checked against the exact domain in the envelope sender or HELO name, so subdomains do not inherit the parent record. Publish a separate record for each subdomain that sends mail, and consider v=spf1 -all for names that never send.