SPFEmail authentication explained

What is an SPF record?

An SPF record is one DNS TXT record at the root of a domain, starting with v=spf1, that lists the servers allowed to send mail for that domain. A receiving server reads it, compares the sending IP with the list and gets pass, fail, softfail or neutral. SPF checks the envelope sender (the Return-Path), so DMARC is what ties it to the From address people see.

How it looks in DNS

TXT
Name
@
Value
v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.10 ~all

A domain that sends from Google Workspace, SendGrid and one own server, and soft-fails everything else

Part by part

The SPF record taken apart

The example above, left to right. Every part is something a receiving server reads.

TXT at @

v=spf1include:_spf.google.cominclude:sendgrid.netip4:203.0.113.10~all

  1. v=spf1Version tag. A TXT record is an SPF record only if it starts with exactly this
  2. include:_spf.google.comAlso allow every server Google's own SPF record lists. Each include costs one DNS lookup, plus the lookups inside it
  3. include:sendgrid.netThe same for SendGrid. Every service that sends as the domain needs its include here, in this one record
  4. ip4:203.0.113.10Allow one IPv4 address (or a range such as /24). ip4 and ip6 cost no DNS lookups
  5. ~allEverything not matched above soft-fails: accepted and usually filtered. -all fails it outright, ?all says nothing, +all passes every server on the internet

Look up the SPF record of any domain

The same check as our SPF checker: the record is read live from DNS in your browser and every part is explained. Try your own domain, or a big sender to see a working record.

Try

Every include is followed to the end and counted. Lookups go from your browser to Cloudflare's public DNS resolver; nothing is stored.

  • Every include followed, with its own lookup count
  • Lookups against the limit of 10, void lookups against 2
  • Each mechanism and the all ending in plain words
  • The corrected record, ready to paste into your DNS

How it works

What a receiving server does with SPF

  1. Read the envelope sendersource (opens the vendor's page in a new tab)

    The server takes the domain of the MAIL FROM address (the Return-Path), or the HELO name when the envelope sender is empty

  2. Fetch the recordsource (opens the vendor's page in a new tab)

    It looks up TXT records at that domain and keeps the one that starts with v=spf1. Two such records are a permerror

  3. Walk the mechanismssource (opens the vendor's page in a new tab)

    Left to right: include, a, mx, ip4, ip6, exists. The first mechanism that matches the sending IP decides the result

  4. Return a resultsource (opens the vendor's page in a new tab)

    pass, fail, softfail, neutral, none, or permerror and temperror when the record is broken or DNS times out

  5. Hand it to DMARCsource (opens the vendor's page in a new tab)

    DMARC counts an SPF pass only when the Return-Path domain aligns with the From domain

SPF answers one question: is this server allowed to send for the domain in the envelope? It says nothing about the From header a person reads, which is why a message can pass SPF on a bounce domain like the ones Mailchimp or Postmark use and still fail DMARC on yours. DKIM and DMARC close that gap.

The record lives at the root (@) of each domain that appears in a Return-Path, and every subdomain that sends needs its own. Most problems come from the record growing: each new tool adds an include, nested includes add lookups, and the 11th lookup turns every check into permerror. The SPF checker counts them; SPF flattening and the SPF record generator fix the record.

In our October 2026 check of 2,969 B2B company domains, 2.1% published two SPF records, which fails SPF for every message, and of the domains with SPF 61% ended in ~all and 36% in -all (the data).

Reference

SPF mechanisms, modifiers and qualifiers

  • include:<domain>DNS lookups:1, plus its ownEvery server the other domain's SPF record allows; the way providers publish their ranges
  • a / a:<domain>DNS lookups:1The A and AAAA addresses of the domain
  • mx / mx:<domain>DNS lookups:1, max 10 MX hostsThe servers in the domain's MX records; useful when the same servers send and receive
  • ip4:<address or range>DNS lookups:0One IPv4 address or a CIDR range such as 203.0.113.0/24
  • ip6:<address or range>DNS lookups:0One IPv6 address or range
  • exists:<domain>DNS lookups:1Matches when the name resolves; used with macros by a few large senders
  • ptrDNS lookups:1 or moreReverse DNS of the sender. RFC 7208 says it should not be published: slow and unreliable
  • redirect=<domain>DNS lookups:1Use another domain's record when nothing else matched; a shared policy for many domains
  • allDNS lookups:0Matches everything; always last. Its qualifier sets the default result
  • + - ~ ?DNS lookups:0Qualifiers in front of a mechanism: pass (the default when omitted), fail, softfail, neutral

Sourcesource (opens the vendor's page in a new tab)

Rules and limits

What receivers enforce on SPF

By provider

The SPF record for each sending service

The values from each provider's own docs. Open a provider for the full records, the steps in its interface and a check pre-set for it.

Where the record goes

What to type in each field of your DNS panel:

Troubleshooting

Common SPF errors and fixes

For cold email

Mailboxes that come with the DNS records done

Outreach2day buys the domains, publishes SPF, DKIM and DMARC, creates the mailboxes and starts warmup, then sends your campaigns from its own sequencer or exports the mailboxes to Instantly or Smartlead.

Create mailboxesBook a call
  • SPF, DKIM and DMARC set for youOn every domain, checked after setup and kept in place
  • $2.50 a mailbox a month12-mailbox minimum; warmup and the sending engine included
  • 1,000+ mailboxesA volume price per mailbox, quoted on a call

Questions

What does an SPF record look like?

One TXT record at the root of the domain, such as v=spf1 include:_spf.google.com ~all. It starts with v=spf1, lists the allowed senders as includes and IP ranges, and ends with an all term that says what happens to everyone else.

Do I need an SPF record?

Yes, if the domain sends email. Gmail and Yahoo require SPF or DKIM from every sender and both from bulk senders, and a domain with no SPF gives receivers no way to tell your servers from a forger's. A domain that sends no mail should publish v=spf1 -all.

What is the difference between ~all and -all?

~all is a softfail: mail from unlisted servers is accepted and usually filtered. -all is a fail, which receivers may reject. Start with ~all while you confirm every service that sends as the domain, then move to -all if you want the stricter signal.

How many includes can an SPF record have?

There is no fixed number of includes; the limit is 10 DNS lookups in total, counting the lookups inside each include. A record with four includes can already be over the limit if one of them nests several more.

Is SPF enough without DKIM and DMARC?

No. SPF breaks when mail is forwarded and it checks the Return-Path domain only. DKIM survives forwarding, and DMARC ties both to the From address; bulk senders to Gmail, Yahoo and Outlook need all three.

Sources

The RFCs and the mailbox providers' sender rules, checked . Where a mailbox provider's rules change, its own page is the reference.

Deliverability call

Talk to our deliverability team

Book a call with the people who run our mailbox infrastructure. We look at your current setup and tell you what to change. Running 1,000+ mailboxes? We also quote a volume price below every vendor list price in our comparisons, warmup and sending included.

  • Review your domains, DNS records and current inbox placement
  • Size the setup: domains, mailboxes per domain and daily volume per mailbox
  • Plan warmup and the move from your current provider or sequencer
  • 1,000+ mailboxes: a volume price per mailbox for your setup

Free call

See open times in your time zone and book on this page.

Or open the booking page