SPF

SPF (Sender Policy Framework, RFC 7208) lists the servers that are allowed to send email for your domain. The policy is published as a single TXT record at the domain apex; receivers check it against the envelope sender of every incoming message.

A domain must publish exactly one SPF record. If a TXT record starting with v=spf1 already exists, replace it or merge your mechanisms into it – a second record makes SPF fail permanently (permerror). The deprecated ptr mechanism should no longer be published and is never emitted here.

SPF evaluation stops after 10 DNS lookups: every a, mx and include: term counts, and includes count recursively – a single provider include can add three or four lookups (Google's does). ip4: and ip6: terms cost nothing.

Domain

Only used to display the record name – the TXT record is published at the domain apex.

Policy for all other senders (all)

~all (softfail) is recommended when you use DMARC: forwarded mail can fail SPF, and -all would reject it before DMARC can pass it on a valid DKIM signature – with DMARC in place, softfail is just as strict. Choose -all only without DMARC or for non-sending domains. Never publish +all or ?all – they authorize any sender.

IPv4 addresses (ip4:)

Comma- or space-separated; CIDR ranges are allowed.

IPv6 addresses (ip6:)

Comma- or space-separated; CIDR ranges are allowed.

a – authorize the IP addresses of the domain's own A/AAAA records (1 DNS lookup)

mx – authorize the domain's MX hosts (1 DNS lookup)

Provider includes (include:)

Comma- or space-separated domains; one DNS lookup each, and includes expand recursively.

Reads your domain's MX records, detects the mail provider and adds its include:. MX describes inbound mail while SPF authorizes outbound — this suggestion covers your mailbox provider; add includes separately for any other service that sends on your behalf (newsletters, CRM, transactional email).

Other sending services (marketing / transactional)

Tick any service that also sends mail for your domain — newsletters, transactional/API email — to add its include:. These are outbound senders only; your mailbox provider comes from the button above. For services with per-region infrastructure (e.g. CodeTwo) pick the data-center region of your tenant — only that region's include belongs in the record. Mind the 10-lookup limit: every include counts and expands recursively.

Runs entirely in your browser. Record Studio · Verify the result with the domain security check