What SPF does
SPF is the stamp on your email: a list of the servers that are allowed to send as your domain. When a message arrives, the receiving server looks up your SPF record and checks whether the sending server is on it. Mail from anywhere else looks forged.
It's a single TXT record on your domain, for example:
v=spf1 include:spf.protection.outlook.com include:_spf.google.com ~all
Problems the checker finds
- No SPF record at all, so anyone can claim to send as you.
- An SPF record without a
~allor-allending, which lets every sender through. - Records that go over the 10 DNS lookup limit, which makes SPF fail for every message.
Common SPF entries
| Service | Add this to your SPF |
|---|---|
| Microsoft 365 | include:spf.protection.outlook.com |
| Google Workspace | include:_spf.google.com |
| Mailchimp | Not needed in SPF. Mailchimp authenticates with DKIM instead. |
SPF alone isn't enough
SPF only checks the hidden return address, not the From address people see. That's why it works with DKIM and DMARC. The free check above tests all three together.
Common questions
Can I have two SPF records?
No. A domain must have exactly one TXT record starting with v=spf1. With two, receiving servers treat SPF as broken for every message. Merge them into one record with all the include: entries together.
Should my SPF end in ~all or -all?
Either is fine once DMARC is enforcing. ~all (soft fail) is the common, forgiving choice. -all (hard fail) is stricter. Avoid ?all and +all, which tell servers not to treat unknown senders as a problem.
What is the 10-lookup limit?
SPF may trigger at most 10 DNS lookups through include:, a, mx, ptr, exists and redirect. Go over and SPF fails completely. Remove services you no longer use, or replace a large include with the specific IP ranges.
What SPF record does Microsoft 365 need?
If Microsoft 365 is your only sender, v=spf1 include:spf.protection.outlook.com -all. Add an include: for each other service that sends as your domain.