SPF Record
An SPF record is a DNS TXT record that lists which hosts are allowed to send mail for a domain using Sender Policy Framework (RFC 7208).
Basic syntax
Publish one SPF TXT record on the domain (or subdomain) used in the SMTP envelope. Multiple SPF TXT records are invalid.
v=spf1 include:spf.protection.outlook.com include:_spf.google.com -allMechanisms and qualifiers
Common mechanisms include ip4, ip6, include, a, mx, and exists. Qualifiers: + pass, - fail, ~ softfail, ? neutral.
- Keep total DNS-causing mechanisms ≤ 10 lookups
- Prefer -all once inventory is complete
- Never publish two v=spf1 TXT records on the same name
Microsoft 365 & Google examples
M365 commonly needs include:spf.protection.outlook.com. Google Workspace commonly needs include:_spf.google.com. Add ESP includes carefully to avoid lookup overages.
How QuickDMARC helps
Use the SPF checker and QuickSPF when includes exceed the 10-lookup limit.
Frequently asked questions
Where is the SPF record published?
As a TXT record on the sending domain (often the apex or a dedicated mail subdomain).
Is SPF enough without DMARC?
SPF helps authorization but DMARC adds alignment, reporting, and policy.
Can I use ~all forever?
~all is softer; many programs move to -all with DMARC.