How to create an SPF TXT record

To create an SPF record you add a single DNS TXT record to your domain that starts with v=spf1, lists every service authorized to send your email, and ends with an all mechanism. You publish it at your domain's root, wait for DNS to propagate, and then validate it. The whole process takes a few minutes plus propagation time, and the key is making sure every legitimate sender is included before you enforce a hardfail.

Step by step

1. 1

   1. List every sending source

   Write down every service that sends email as your domain: your mailbox provider, marketing platform, CRM, support desk, and any transactional sender. Missing one will cause its mail to fail.

2. 2

   2. Find each vendor's SPF value

   Each provider publishes an include value or IP range, for example include:_spf.google.com for Google Workspace or include:sendgrid.net for SendGrid. Collect them all.

3. 3

   3. Build one record

   Combine them into a single string that begins with v=spf1, followed by your mechanisms, ending in your chosen all qualifier. Use ip4 or ip6 for fixed servers to avoid extra lookups.

4. 4

   4. Choose your all qualifier

   Use ~all (softfail) while testing so nothing is blocked, then switch to -all (hardfail) once every sender is confirmed.

5. 5

   5. Publish the TXT record

   In your DNS host, create a TXT record at the root of your domain (host @ or blank) with the SPF string as the value. Save only one SPF record.

6. 6

   6. Wait and validate

   Allow DNS to propagate, then run a checker to confirm the syntax, the single-record rule, and that you are under 10 lookups.

Rules that keep it valid

A few constraints decide whether your record works. Break any of these and receivers may return a permerror that fails your mail quietly.

• Publish exactly one SPF TXT record. Two records cause a permerror.
• Stay under 10 DNS lookups across all includes and nested chains.
• Start with v=spf1 and end with a single all mechanism.
• Use ip4 and ip6 for fixed IPs, since they add no lookup cost.
• Include every real sender before switching to -all.

Keeping it under 10 lookups

The moment you add several vendors, your lookup count climbs and can cross the limit. EmailAuth SmartSPF flattens your include chains into one optimized record and keeps vendor IP ranges for Microsoft 365, Google Workspace, Salesforce, and SendGrid synced as they change, so you never have to hand-edit again. A free domain scan expands your chain and counts your lookups before you publish. Once SPF is live, add DKIM signing and a DMARC policy so authentication survives forwarding and protects your visible From address.

Frequently asked questions