What is an SPF record?
What is an SPF record?
SPF, which stands for Sender Policy Framework, is an email authentication method that lists the servers allowed to send email for your domain. An SPF record is a TXT record in your DNS (Domain Name System) settings that publishes that list.
When a message arrives, the receiving server checks whether it came from a server on your list. SPF helps stop spammers from sending email that pretends to come from your domain. It works together with DKIM and DMARC to protect your domain and improve deliverability.
How does SPF work?
- Publish: You add an SPF record to your domain's DNS that lists every server and service authorized to send your email.
- Send: Your email goes out with a return-path address (also called the envelope sender or MAIL FROM), which is where bounces are sent.
- Check: The receiving server looks up the SPF record for the return-path domain and compares the sending server's IP address against it.
- Result: If the IP address is on the list, SPF passes. If not, SPF fails or soft-fails, and the receiver decides how to handle the message, often guided by your DMARC policy.
SPF validates the hidden return-path domain, not the From address your recipients see. That's why DMARC matters: it checks that the domain SPF validated aligns with your visible From domain.
What an SPF record looks like
Here's a simple example:
v=spf1 include:_spf.google.com ip4:203.0.113.10 ~all
| Part | What it means |
|---|---|
v=spf1 | Identifies the record as SPF. Every SPF record starts with this. |
include: | Authorizes another domain's servers, such as your email provider's |
ip4: / ip6: | Authorizes a specific IP address or range |
a / mx | Authorizes the servers in your domain's A or MX records |
~all | Soft fail: mail from anywhere else is suspicious but not rejected outright |
-all | Hard fail: mail from anywhere else should be rejected |
Avoid +all, which authorizes every server on the internet and defeats the purpose of SPF. The ptr mechanism is also discouraged.
Common SPF mistakes
| Mistake | Why it's a problem | How to fix it |
|---|---|---|
| More than one SPF record | Receivers treat multiple SPF records as an error, so SPF fails | Combine everything into a single record |
| Too many DNS lookups | SPF allows a maximum of 10 lookups (include, a, mx, exists, redirect); exceeding it causes a permanent error | Remove unused services and consolidate includes |
| Missing a sending service | Mail from that service fails SPF | Add every tool that sends as your domain |
| Using +all | Lets anyone send as your domain | Use ~all or -all |
| Relying on SPF alone | SPF breaks when messages are forwarded | Add DKIM and DMARC |
These rules come from the SPF standard, RFC 7208.
Why SPF matters for deliverability
Mailbox providers now require authentication. Gmail requires all senders to set up SPF or DKIM, and bulk senders (5,000+ messages a day) to have SPF, DKIM and DMARC. Yahoo has similar rules, and since May 5, 2025, Microsoft rejects high-volume mail to Outlook.com, Hotmail and Live addresses that fails these checks.
Sources: Google sender guidelines, dmarcian on Microsoft's requirements. Learn more about the Gmail and Yahoo inbox protection rules.
How to check your SPF
Send an email to a Gmail account, open it, and choose Show original. Look for SPF: PASS. In other mail apps, check the full message headers for an Authentication-Results line containing spf=pass. You can also look up your domain's SPF record with a free DNS lookup tool to confirm there's only one record and it's under the 10-lookup limit.
Setting up SPF in DailyStory
DailyStory sends your email from a dedicated subdomain, such as ds.example.com, and provides the SPF and DKIM records for it. Because the records live on the subdomain, you don't need to edit your main domain's existing SPF record. Add the records at your DNS provider, and DailyStory shows a green check when each one is verified, usually within 20 to 30 minutes.
Find step-by-step instructions in Setting up your email domain and Configuring SPF, DKIM and DMARC.
Frequently asked questions
Should I use ~all or -all?
Many organizations start with ~all (soft fail) while confirming every legitimate sender is listed, then rely on DMARC to enforce a stricter policy. Use -all (hard fail) only once you're confident your record is complete.
Can I have more than one SPF record?
No. A domain or subdomain should have exactly one SPF record. If you use several email services, combine them into a single record with multiple include statements.
Is SPF enough on its own?
No. SPF breaks when email is forwarded and only checks the return-path domain. Pair it with DKIM and DMARC for complete protection, which is also what Gmail, Yahoo and Microsoft require of bulk senders.