SPF guide
Every part of an SPF record explained, with copy-ready examples for Google Workspace, Microsoft 365 and more.
An SPF record is one TXT record at the root of your domain (name @). It starts with v=spf1, lists who may send for you, and ends with a rule for everyone else. Inboxes read it left to right and stop at the first part that matches the sending server.
v=spf1 include:_spf.google.com ~all
| Part | What it means | Lookups |
|---|---|---|
v=spf1 | Marks the record as SPF. Always first, only once. | 0 |
include:domain | Allow everyone that domain’s SPF record allows. How you add a service. | 1 or more |
a | Allow the IP address your domain points to. | 1 |
mx | Allow your inbox (MX) servers. | 1 |
ip4: / ip6: | Allow a fixed address or range, such as ip4:203.0.113.0/24. | 0 |
exists: | An advanced rule used by some large providers. | 1 |
ptr | Outdated. Don’t use it. | 1 |
redirect=domain | Use another domain’s SPF record instead of this one. | 1 |
all | Everyone else. Always last. | 0 |
| Prefix | Result | Example |
|---|---|---|
+ (or nothing) | Pass | include:_spf.google.com |
~ | Soft fail: accept but treat as suspicious | ~all |
- | Fail: reject | -all |
? | Neutral: no opinion | ?all |
Google Workspace only:
v=spf1 include:_spf.google.com ~all
Microsoft 365 only:
v=spf1 include:spf.protection.outlook.com ~all
Google Workspace, Mailchimp and your own server:
v=spf1 ip4:203.0.113.10 include:_spf.google.com include:servers.mcsv.net ~all
A domain that never sends email:
v=spf1 -all
all is ignored.Build or check your record
Pick your services and get a correct record with every lookup counted, or check the one you have.