TXT
TXT Record: SPF
SPF is published as a TXT record at your domain root. Learn the exact format, mechanisms, qualifiers, and the 10-lookup limit.
Published · Last verified · Maintained by TamingDNS
TXT
Authentication (TXT)
RFC 7208
Yes
TXT "v=spf1 <mechanisms> <qualifier>all"
TXT "v=spf1 include:_spf.google.com ip4:203.0.113.5 -all"
3600 s; lower (300 s) during rollout so failures expire quickly
💬 What This Record Does
Sender Policy Framework (SPF) is published as a TXT record at your bare domain (e.g., example.com). It lists which IP addresses and services are allowed to send email on your behalf. Receiving servers check this record against the sending IP and use the result, Pass, Fail, SoftFail, to decide whether to accept or reject the message. SPF alone doesn't stop spoofing; it must be combined with DMARC for full protection.
Common Uses
- Authorising Google Workspace, Microsoft 365, or other ESPs to send from your domain
- Hardening your domain against spoofing as part of a SPF + DKIM + DMARC setup
- Diagnosing delivery failures caused by unauthorised senders
⚠️ Watch Out For
- There must be exactly one SPF TXT record on your domain root. Multiple records cause a permerror.
- SPF has a limit of 10 DNS lookups. Exceeding it causes a permerror treated as a hard fail.
- SPF only protects the envelope sender (Return-Path), not the From: header visible to users.
🔧 Related Tools
📋 Complete Example Records
Whole records in zone-file form: name, TTL, class, type, then the data. Most DNS panels ask for the pieces separately. Look them up live with the DNS Lookup tool.
example.com. 3600 IN TXT "v=spf1 include:_spf.google.com ~all"
SPF goes on the domain itself, not on a subdomain like _spf. Anything at _spf.example.com is a helper record your main one includes.
example.com. 3600 IN TXT "v=spf1 include:_spf.google.com ip4:192.0.2.5 -all"
A cloud provider plus one server of your own, ending in a hard fail. This is what a finished SPF record looks like for most domains.
example.com. 3600 IN TXT "v=spf1 include:_spf.google.com ~all" example.com. 3600 IN TXT "v=spf1 include:spf.protection.outlook.com ~all"
Two SPF records, and the usual cause of a sudden permerror. RFC 7208 §3.2 forbids it, and the fix is one record containing both includes.
subdomain.example.com. 3600 IN TXT "v=spf1 -all"
Subdomains do not inherit SPF. A subdomain that sends no mail needs its own record saying so.