SPF (Sender Policy Framework) is a DNS TXT record that tells receiving servers which IP addresses are authorised to send email for your domain. A missing or broken SPF record is one of the most common causes of legitimate email landing in spam. This guide covers the correct syntax, the most common mistakes (including the 10-lookup limit), and how to verify SPF is working before you send.
v=spf1 include:_spf.google.com include:spf.protection.outlook.com ip4:203.0.113.5 -all
v=spf1
Required. Declares this is an SPF version 1 record.
include:domain.com
Authorises all IPs in domain.com’s own SPF record. Costs 1 DNS lookup.
ip4:x.x.x.x
Authorises a specific IPv4 address. No lookup cost - use for static IPs.
ip6:xxxx::/48
Authorises an IPv6 range. Also no lookup cost.
a
Authorises the IP address(es) in your domain’s A record.
-all
Final qualifier. Reject all senders not matched above (hardfail).
| Provider | include: mechanism | Notes |
|---|---|---|
| Google Workspace | include:_spf.google.com | Covers all Google sending IPs |
| Microsoft 365 | include:spf.protection.outlook.com | Covers Exchange Online sending IPs |
| SendGrid | include:sendgrid.net | For transactional email via SendGrid |
| Mailchimp / Mandrill | include:spf.mandrillapp.com | For Mailchimp transactional sending |
| Amazon SES | include:amazonses.com | Alternatively use ip4: for specific SES IPs |
| Postmark | include:spf.mtasv.net | Postmark’s SPF include |
| Instantly / Smartlead | Check in-app DNS settings | They use their own SMTP infrastructure; specific include provided on domain connection |
SPF evaluation may trigger at most 10 DNS lookups. Each include:, a, mx, and ptr mechanism counts as a lookup, plus any lookups triggered recursively. Exceeding 10 returns permerror - which most receivers treat as a hard fail.
Run MXToolbox SPF Check on your domain. It counts the total lookups and flags permerror. Alternatively, use: dig TXT yourdomain.com then manually count includes.
Replace include: mechanisms with ip4: or ip6: directives using the actual IPs. No lookup cost. Run a DNS lookup on the include domain to find its IPs, then use those directly.
Audit includes against your actual mail flow. If you stopped using a provider, remove their include. Common culprits: old ESPs, discontinued tools, services you no longer use.
Services like EasyDMARC, dmarcian, or AutoSPF automatically flatten your SPF record into a single ip4: list and keep it updated as provider IPs change.
-all
Recommended once your SPF record is complete and tested. Receiving servers should reject mail from unlisted IPs. The strongest stance.
~all
Receiving servers should accept the mail but mark it as suspicious. Use while building out your SPF record or if you have uncertain sending sources.
?all
The domain makes no assertion about senders not in the list. Almost never the right choice for an established domain.
+all
Never use this. It means “all servers are authorised to send as your domain” which defeats the entire purpose of SPF.
You can only have one SPF TXT record per domain. If you have two, both are ignored and SPF returns permerror. Merge all your includes into a single record.
If you send from outreach.yourdomain.com or mail.yourdomain.com, each needs its own SPF record (or a wildcard). The root domain’s SPF does not cover subdomains automatically.
ptr: triggers a reverse DNS lookup and additional forward lookup per IP - very slow and counts against the 10-lookup limit. Never use ptr:.
~all is for testing. Once your SPF record is stable, switch to -all. Leaving softfail in place long-term means compromised senders from unlisted IPs still get through.
Every domain you send cold email from (e.g. try-yourcompany.com) needs SPF. A domain with no SPF fails authentication immediately.
SPF, DKIM, and DMARC stop impersonation. List verification stops bounces. Run both before every campaign - 100 free credits, no card required.
Ayoub built BounceZero's 5-stage validation pipeline, its dedicated BGP-announced IP infrastructure, and the Patroni HA PostgreSQL cluster behind every verification. Previously built high-volume email delivery infrastructure. Trained at 1337 Benguerir (École 42 network, 2019). Open-source: bgp_analyzer.
Provider behaviour, DNS setup, warm-up, and inbox placement
Min age before cold email, warmup vs age, new domain setup checklist
Generate, publish, and verify DKIM - Google Workspace, M365, and custom SMTP
DNS records, DMARC policy progression, verification commands, cold email setup
How to set up SPF, DKIM, and DMARC in 2026: exact DNS records, verification commands, common
How to warm up a new email domain in 2026: the right tool, a realistic 30-day timeline
Benchmarks, Apple MPP inflation explained, and what metrics to track instead
Continue through related topics