DNS guide

SPF Record Setup Guide

An SPF record lists the servers authorised to send email for your domain. Without one, any server can send email pretending to be from your domain. Here's how to build the right SPF record for your setup.

The golden rule

One SPF record per domain. Only one TXT record can start with v=spf1. Two SPF records = immediate PermError.

Building your SPF record

Google Workspace only

v=spf1 include:_spf.google.com ~all

Google + SendGrid

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Google + SendGrid + Microsoft 365

v=spf1 include:_spf.google.com include:sendgrid.net include:spf.protection.outlook.com ~all

Self-hosted mail + Google

v=spf1 ip4:203.0.113.10 include:_spf.google.com ~all

Verify SPF and lookup tree

Open DNS Preflight →
Related: SPF record · SPF too many lookups · SPF PermError

Step by step

Step 1 List all services that send email for your domain.
Step 2 Find each service's SPF include value.
Step 3 Check for existing SPF record — merge, don't duplicate.
Step 4 Publish as a single TXT record at @ with TTL: Auto.
Step 5 Run DNS Preflight to verify SPF and check lookup count.
Step 6 Check lookup count is under 10 — expand the SPF tree in DNS Preflight to see the count.

FAQ

What is an SPF record?

A TXT record that lists which servers are authorised to send email for your domain. Receivers check it to verify your email is legitimate.

What does ~all mean in SPF?

Softfail — unauthorised servers are marked suspicious but email is usually delivered. Start with ~all, switch to -all once all senders are confirmed.

How many DNS lookups does my SPF use?

Run DNS Preflight — the SPF tree shows each include expanded with a running count. Must stay under 10.

What if I need more than 10 lookups?

Flatten high-lookup providers by replacing include: with their actual IP addresses. See the SPF too many lookups fix guide.

Do I need SPF if I have DKIM?

Yes. SPF and DKIM serve different purposes. DMARC requires both to be configured for full protection.

← All DNS record guides

Open DomainPreflight →