What does the SPF include Mechanism do?

`include`: SPF Mechanism

The SPF include mechanism delegates SPF evaluation to another domain's SPF record. Learn syntax, usage, and lookup-limit implications.

Published May 10, 2026 · Last verified August 7, 2026 · Maintained by TamingDNS

Type
Mechanism

Syntax
include:<domain>

DNS Lookup
Yes (counts toward 10-lookup limit)

Example
include:_spf.google.com

💬 What This Mechanism Does

The include mechanism tells receiving mail servers to also check another domain's SPF record. It's how you authorise a third-party email service (like Google Workspace, Mailchimp, or SendGrid) to send on your behalf. If the third party's SPF record passes, your record passes for that mechanism.

When to Use This

Authorising Google Workspace to send from your domain (include:_spf.google.com)
Authorising Microsoft 365 (include:spf.protection.outlook.com)
Authorising a marketing platform like Mailchimp or HubSpot
Referencing a shared company-wide SPF record from a subdomain

⚠️ Watch Out For

Each include counts as one of your 10 allowed DNS lookups. Nesting includes adds up fast.
If the included domain has no SPF record, the result is "permerror", a hard failure.
You cannot use include to share an IP list; use ip4:/ip6: for that.

📋 Complete Example Records

Every one of these is a complete record you can paste as it stands. Try one in the SPF Checker or build your own with the SPF Builder.

v=spf1 include:_spf.google.com ~all

One include covers every Google sending IP, so you never list the ranges yourself and Google can change them without you touching your record.

v=spf1 include:spf.protection.outlook.com -all

The Microsoft 365 equivalent, ending in a hard fail once you are confident nothing else sends as your domain.

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

Two senders, two includes, two of your ten lookups. Order does not matter here: an include that does not match just hands over to the next term (RFC 7208 §5.2).

v=spf1 include:servers.mcsv.net -all

If the included record ends in its own "-all", that "-all" does not end the check. Only whether the recursive lookup matched comes back, so your own "-all" is what decides the outcome.