What is an SPF Record?

The problem SPF solves

By default, anyone on the internet can send an email that looks like it came from your domain. No password required. This is how phishing and email spoofing work — a scammer sends "invoice@yourcompany.com" from a server in another country, and your customers have no way to tell it's fake.

SPF (Sender Policy Framework) fixes this. You publish a short DNS record that says:"Only these specific mail servers are authorised to send email as my domain."Receiving mail servers check this record before accepting your email.

What an SPF record looks like

An SPF record is a TXT record in your DNS. It looks something like this:

v=spf1 include:_spf.google.com include:sendgrid.net -all

Breaking that down:

• v=spf1 — declares this is an SPF record
• include:_spf.google.com — Google's servers are allowed to send for you (if you use Gmail/Google Workspace)
• include:sendgrid.net — SendGrid is also allowed (if you use it for marketing emails)
• -all — reject everything else

The difference between -all and ~all

The ending of your SPF record is the most important part:

• -all (hardfail) — mail from unlisted servers should be rejected. This is what you want.
• ~all (softfail) — mail from unlisted servers is accepted but marked as suspicious. Weaker protection.
• +all — authorises every server on the internet to send as you. Never use this.

If you're confident you've listed all your sending services, use -all. It gives much stronger spam protection.

The 10 DNS lookup limit

SPF has a hidden trap: you're only allowed 10 DNS lookups during evaluation. Everyinclude:, a:, and mx: mechanism counts as a lookup. Go over 10 and receiving servers return a "permerror" — which many treat the same as an SPF failure.

This catches people by surprise when they add a new email tool (a CRM, a helpdesk, a transactional email service) and suddenly their SPF breaks. The fix is SPF flattening — replacing include chains with their raw IP addresses.

What happens without SPF?

Without an SPF record:

• Anyone can send email pretending to be you
• Your legitimate emails are more likely to land in spam
• You can't use DMARC properly (which requires SPF or DKIM to pass)

How to add an SPF record

Log in to wherever you manage your DNS (Cloudflare, GoDaddy, Namecheap, Route 53, etc.) and add a TXT record at your root domain (@) with this value as a starting point:

v=spf1 include:[your-mail-provider] -all

Replace [your-mail-provider] with the SPF include your mail provider gives you. Google Workspace uses _spf.google.com. Microsoft 365 uses spf.protection.outlook.com.