In short
- One SPF TXT record per domain — never two.
- Include every legitimate sender: SMTP provider, helpdesk, CRM.
- Stay under the 10-lookup limit or SPF fails outright.
- -all is strict, ~all is soft-fail; start soft if unsure.
Steps
- List every service that sends mail using your domain.
- Collect the SPF include value each one documents.
- Build one record: v=spf1 include:a.com include:b.com ~all
- Publish it as a TXT record at your domain root (@).
- Wait for propagation, then verify with a live SPF lookup.
- Tighten ~all to -all once you are confident the list is complete.
Record anatomy
Minimal
v=spf1 include:your-smtp-provider.com ~allMultiple senders
v=spf1 include:smtp-provider.com include:helpdesk.com ip4:203.0.113.10 -allThe mistakes that break SPF
- Two SPF records on one domain — this invalidates SPF entirely.
- Exceeding 10 DNS lookups through chained includes.
- Using +all, which authorises the entire internet.
- Forgetting a legitimate sender, so real mail fails.
- Publishing SPF on the root domain but sending from an unauthorised subdomain.
SPF is not enough on its own
SPF breaks when mail is forwarded, and it authenticates the envelope sender rather than the visible From address. Pair it with DKIM and DMARC so your mail still authenticates after forwarding.
Checklist
- Exactly one SPF TXT record.
- Every legitimate sender included.
- Under 10 DNS lookups.
- Ends in ~all or -all, never +all.
- Verified with a live lookup after propagation.
Run these checks now
Questions people ask
What is the difference between ~all and -all?
~all is soft-fail: receivers accept but mark the mail. -all is hard-fail: receivers may reject it. Start with ~all and move to -all once your sender list is complete.
How do I count SPF lookups?
Each include, a, mx, exists, and redirect mechanism costs a lookup, including the ones nested inside your providers' records. Exceeding 10 makes SPF fail permanently.
Do subdomains inherit SPF?
No. Each sending subdomain needs its own SPF record.