SPF guide: declare who sends your email
SPF lists the servers allowed to send email on behalf of your domain. Here is how to write it, set it up for Microsoft 365 or Google Workspace, and avoid the mistakes that make it invalid.
What SPF is for
Technically, nothing stops any server from sending an email that claims to come from exemple.nc. SPF (Sender Policy Framework, RFC 7208) lets the domain owner publish, in a TXT record, the list of servers allowed to send on its behalf.
The server that receives an email compares the sender's IP address with this list. If the address is not on it, the last term of the record, all, says what to do: reject, mark as suspicious or draw no conclusion.
SPF checks the technical sending address (the "Return-Path"), not the address shown to the recipient. It is DMARC that links the two and genuinely protects against spoofing of your address.
An SPF record explained
A domain that sends its email with Microsoft 365, its newsletters with Brevo, and alerts from an internal server at a fixed address:
exemple.nc. TXT "v=spf1 include:spf.protection.outlook.com include:spf.brevo.com ip4:203.0.113.25 -all"| Term | Meaning |
|---|---|
v=spf1 | The mandatory start of every SPF record. |
include:spf.protection.outlook.com | Authorises the servers listed in Microsoft 365's SPF record. Costs one DNS lookup, plus those of the included record. |
include:spf.brevo.com | Authorises Brevo's servers. |
ip4:203.0.113.25 | Authorises a specific IPv4 address (or a range, with a mask such as /28). Costs no DNS lookup. |
-all | Any other server is rejected. |
The other mechanisms are a (the domain's addresses), mx (those of its MX servers), exists, ip6 and ptr, which is discouraged. The redirect= modifier hands the whole policy over to another domain.
The four endings
-all(fail): servers not listed are rejected. This is the recommended ending.~all(soft fail): emails are accepted but marked as suspicious. Enough if DMARC is atp=reject.?all(neutral): no conclusion. The SPF record protects nothing.+all: every server in the world is allowed. Never use it.
Setting up SPF for Microsoft 365
- List every service that sends email with your domain: Microsoft 365, but also your newsletter software, your CRM, your website, your copiers or your business software.
- At your domain's DNS host, create or edit the TXT record of the domain itself (name
@, or left blank depending on the interface):v=spf1 include:spf.protection.outlook.com -all - Before
-all, add anincludeor anip4address for each of the other services. There must be only onev=spf1record. - If your DNS is managed by Microsoft 365, the record is edited in the Microsoft 365 admin center, under Settings, then Domains.
- Run Domain Check again once the change is visible.
Microsoft documentation: set up SPF for Microsoft 365 (opens in a new tab).
Setting up SPF for Google Workspace
- At your domain's DNS host, create a TXT record on the domain itself:
v=spf1 include:_spf.google.com ~all - This is the value Google gives. Once all your sending services are listed, you can end it with
-all; with DMARC atp=reject,~allgets the maximum score in Domain Check in any case. - Before
all, add theincludeterms of your other sending services, in the same record.
Google documentation: set up SPF (opens in a new tab).
Setting up SPF with another provider
Each sending service publishes the value to include in its documentation. A few common values, to be confirmed with the service:
| Service | Term to add |
|---|---|
| OVHcloud | include:mx.ovh.com |
| Gandi | include:_mailcust.gandi.net |
| Infomaniak | include:spf.infomaniak.ch |
| Brevo | include:spf.brevo.com |
| Mailjet | include:spf.mailjet.com |
| SendGrid | include:sendgrid.net |
| Amazon SES | include:amazonses.com |
| Server with a fixed address | ip4: followed by the server's public address |
Combine them into a single record, for example v=spf1 include:mx.ovh.com include:spf.brevo.com -all. If a value is longer than 255 characters, the record is split into several quoted strings, which servers join back together without a space: "v=spf1 include:… " "include:… -all". Most DNS interfaces do this for you.
The 10 DNS lookup limit
To check an SPF record, the recipient makes no more than 10 DNS lookups. Each include, a, mx, ptr, exists and redirect costs one, including in the included records. Beyond that, the SPF record is invalid and all your emails fail the check. The ip4, ip6 and all terms cost nothing. Domain Check counts these lookups and shows the include tree.
To stay under the limit: remove the services you no longer use, replace a and mx with ip4 addresses where possible, or send your campaigns from a subdomain with its own SPF record.
Common mistakes
- Two SPF records. Adding a second
v=spf1for a new service, instead of completing the first one, makes both invalid. - A forgotten service. The invoicing software or website form that sends in the domain's name has its emails rejected as soon as you move to
-all. - More than 10 DNS lookups. Common when Microsoft 365, a CRM, a newsletter platform and a support tool are combined.
- An
includepointing to a name that no longer exists. A cancelled service or a typo: the whole SPF record becomes invalid. - Ending in
+allor?all. The SPF record exists but protects nothing. With+all, Domain Check caps the overall score at 49. - The
ptrmechanism. Slow, unreliable and discouraged by the standard. - Domains that send nothing. They must publish
v=spf1 -all, otherwise they can still be used to impersonate you.
Check your SPF. Domain Check reads your record, follows every include, counts the DNS lookups and offers you a corrected record, ready to copy. Test my domain