What is an SPF record?

An SPF (Sender Policy Framework) record is a DNS TXT record, beginning with v=spf1, that lists the servers allowed to send email for your domain. Receiving servers compare the sending server's IP address with that list and record a pass or fail. SPF is defined in RFC 7208, and a domain should publish only one record.

Why it matters

Without SPF, a receiver has no way to tell whether a server is allowed to send mail using your domain. SPF is one of the signals that mailbox providers weigh when deciding between inbox and spam, and it is one of the two checks (with DKIM) that DMARC relies on. Keep in mind that SPF checks the hidden envelope sender, called the Return-Path, rather than the From address people see.

How to do it

List every service that sends mail for your domain: your mailbox provider, your website host, newsletter and support tools.
Find each provider's SPF instructions. Most give you an include: value or a set of IP ranges.
Combine them into one record and publish it as a TXT record at the root of your domain:

example.com.  TXT  "v=spf1 include:_spf.mailprovider.example ip4:203.0.113.10 ~all"

Read the parts left to right. v=spf1 marks the record. include: borrows another domain's list. ip4: and ip6: allow specific addresses. a and mx allow the addresses your domain's A and MX records point to. The ending sets the default for everything else.
Choose the ending deliberately. -all asks receivers to fail unlisted senders, ~all asks them to treat them as a soft fail, ?all takes no position, and +all allows everyone, which defeats the purpose and should never be used.
Check the result with dig TXT example.com +short and look for exactly one line starting v=spf1.

Crawvix's scan checks "Exactly one SPF record" and "SPF record is valid and safe" for your domain. The details of limits and fixes are in the SPF record guide.

Common mistakes

Publishing two SPF records. RFC 7208 treats that as an error, so merge them into one.
Going over the limit of 10 DNS lookups. See how to fix SPF too many DNS lookups.
Ending with +all.
Forgetting a service, such as a contact form plugin, so its mail fails.
Expecting SPF alone to stop forged From addresses. That is what DMARC adds.

Frequently asked questions

Where do I publish an SPF record?

In your domain's DNS zone, as a TXT record. The old dedicated SPF record type is no longer used.

Does SPF survive email forwarding?

Often not. A forwarding server has a different IP address, so the SPF check can fail at the final receiver. DKIM usually survives forwarding better.

Do subdomains need their own SPF record?

SPF is looked up for the domain used in the envelope sender. If you send mail from a subdomain, that subdomain needs its own record.

Want to see how your domain's SPF looks? Try the free website sample.