[ Quick answer ]
An SPF record is a single TXT record on your domain that begins v=spf1, lists authorized senders with mechanisms such as include:, ip4: and ip6:, and ends with an all qualifier. Example: v=spf1 include:_spf.google.com ip4:203.0.113.10 -all.
Key facts
- ›Mechanisms: ip4, ip6, a, mx, include, exists; modifier: redirect.
- ›Qualifiers: + pass, ~ softfail, - fail, ? neutral.
- ›Keep within 10 DNS lookups and 255 characters per string.
- ›Avoid ptr and +all.
Reviewed 2026-11-02 · EmailAuth research team
An SPF record is a single DNS TXT record that lists every server and service authorized to send email for your domain. It starts with the version tag v=spf1, contains a series of mechanisms that define authorized sources, and ends with an all mechanism that sets the default answer for anything not listed. Receiving mail servers read this record to decide whether a connecting server is allowed to send as your domain.
Example SPF record
v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.5 -all
The mechanisms explained
Each mechanism describes one way to authorize a sender. The receiver evaluates them left to right and stops at the first match. Some mechanisms trigger DNS lookups and count toward the 10-lookup limit set by RFC 7208.
- include: pulls in another domain's SPF record, common for vendors like _spf.google.com, and counts as a lookup.
- ip4: authorizes a specific IPv4 address or range, with no DNS lookup cost.
- ip6: authorizes a specific IPv6 address or range, with no DNS lookup cost.
- a: authorizes the IPs in the domain's A record, and counts as a lookup.
- mx: authorizes the mail servers in the domain's MX records, and counts as a lookup.
- all: the catch-all at the end that decides what happens to unlisted sources.
Hardfail versus softfail: -all and ~all
The qualifier in front of all changes how strict your record is. Use -all (hardfail) to tell receivers that any server not listed is not authorized and the message should be rejected or treated as failing. Use ~all (softfail) to say that unlisted servers are probably not authorized but should be accepted and marked, which is useful while testing. A hardfail is the stronger stance once you are confident every legitimate sender is included. Avoid +all, which authorizes everyone and defeats the purpose.
Softfail while testing
Start with ~all to observe results without blocking mail, then move to -all once every sender is confirmed.
One record, watch your lookups
A domain must publish exactly one SPF record. Two SPF TXT records cause a permerror. As you add vendors, each include expands into further lookups, and popular services stack up fast. When you cross 10 lookups the record fails silently for legitimate mail. EmailAuth SmartSPF flattens your include chains into one optimized record and keeps vendor IP ranges for Microsoft 365, Google Workspace, Salesforce, and SendGrid synced automatically. A free domain scan shows your current mechanisms and lookup count. Pair SPF with DKIM and DMARC so alignment holds even when mail is forwarded.
Frequently asked questions
What is the difference between -all and ~all in an SPF record?
-all is a hardfail that tells receivers to reject or fail any server not listed in the record. ~all is a softfail that accepts unlisted senders but marks them as suspicious. Use ~all while testing and -all once every legitimate sender is included.
Can I have more than one SPF record?
No. A domain must publish exactly one SPF TXT record. Two or more SPF records cause a permerror and break authentication. Merge all sources into a single record starting with v=spf1.
Do ip4 and ip6 mechanisms count toward the 10 lookup limit?
No. ip4 and ip6 authorize addresses directly and require no DNS resolution, so they do not consume lookups. Mechanisms like include, a, mx, ptr, and exists do count toward the limit of 10.
What does the include mechanism do?
The include mechanism imports another domain's SPF record, which is how you authorize third-party senders like Google Workspace or SendGrid. Each include counts as at least one DNS lookup, and any nested includes inside it add more.
How do I check my SPF record?
Use an SPF checker. It fetches the record, expands each include and counts DNS lookups against the 10 limit.
How do I combine SPF records?
Merge the mechanisms of both records into one v=spf1 record and keep a single all at the end.
Should I use ~all or -all?
Use ~all while you confirm every sender, then -all. With DMARC at p=reject, either works because DMARC makes the final decision.
[ SPF guide ]
[ Get a free DMARC assessment ]
Free DMARC assessment
We check your domain and send a short report with the steps to full enforcement.