What is an SPF record?
An SPF record is a short line of text in your domain's DNS that lists the services allowed to send email as your business. When a mail server receives a message from you, it looks up that list and checks the sending server is on it. If the list is missing or wrong, your genuine mail can be filtered or bounced.
Last updated
The short answer
SPF (Sender Policy Framework) is a single TXT record on your domain that lists every server and service allowed to send email for it. Receiving servers compare the sending server with that list. A domain must have exactly one SPF record and it should end in -all or ~all. For Microsoft 365 the usual record is v=spf1 include:spf.protection.outlook.com -all. For Google Workspace it is v=spf1 include:_spf.google.com ~all. SPF is one of three records, alongside DKIM and DMARC.
What SPF checks, and what it does not
SPF checks the hidden sending address used between mail servers (the envelope sender, also called the Return-Path), not the name and address your customer sees in the From line. That is why a message can pass SPF and still look fake to a person. Closing that gap is the job of DMARC, which asks that the SPF or DKIM result lines up with the visible From domain. The full rules are in RFC 7208.
Reading an SPF record
v=spf1
Every SPF record starts with this. It tells the receiving server that the text is an SPF record, version 1.
include: and ip4:
The list of allowed senders. An include: hands the question to another provider, such as Microsoft or Google. An ip4: allows one fixed address, such as your own server.
-all or ~all
The ending says what to do with anything not on the list. -all means reject it (hard fail). ~all means accept it but mark it suspicious (soft fail).
One record, in TXT
SPF lives in a TXT record on the main domain (the @ record at your DNS host). There is no special SPF record type to create.
Who this is for
- Owners who have been told "check your SPF record" and want to know what that means.
- Businesses whose invoices, quotes or website form emails go to junk or bounce.
- Anyone who has added a new sending service (accounting, CRM, newsletters, booking) and not updated DNS.
- Whoever is keeping a domain healthy after a move between Microsoft 365, Google Workspace or cPanel hosting.
How to check your own SPF record
- Look the record up. On Windows, open Command Prompt and run
nslookup -type=TXT yourdomain.com.au(use your own domain). Any free SPF checker does the same job. - Find the line that starts v=spf1. There should be exactly one. If you see two lines starting v=spf1, that is a fault: receivers treat it as a permanent error and SPF fails.
- Check every sender is covered. Your mail provider, plus anything else that sends as you: invoicing, CRM, booking, newsletter tool, website forms. A missing one means that service's mail fails SPF.
- Check the ending. It should end in -all or ~all. A record with no ending, or +all, gives you no protection.
- Prove it with a real message. Send an email to an outside address, open the full message headers and look for
spf=passin the Authentication-Results line. In Gmail use Show original. In Outlook open the message properties.
How WaTo can help
- We find every system sending as your domain, then build one clean SPF record that stays under the lookup limit.
- We check SPF together with DKIM and DMARC, because fixing one without the others rarely solves delivery problems. See email deliverability.
- If mail to Outlook.com or Hotmail is bouncing, read the 550 bounce guide first. The SPF wording in those bounces can be misleading.
Setting up SPF on each platform
Microsoft 365. The usual record is v=spf1 include:spf.protection.outlook.com -all. If other services also send as your domain, add them inside the same record before the ending. Microsoft's guidance is in the Microsoft Learn page listed under sources.
Google Workspace. The usual record is v=spf1 include:_spf.google.com ~all. Add other senders inside the same record. Google documents this under Define your SPF record.
cPanel hosting. cPanel can create a starting SPF record for you. Open Email Deliverability in cPanel, check the status for your domain and use the repair option if it offers one. If the domain's DNS is hosted somewhere else (a registrar or Cloudflare), the record has to be added there instead.
Using two platforms at once. Combine them into one record, for example v=spf1 include:spf.protection.outlook.com include:_spf.google.com -all. Never publish a second record.
Common SPF mistakes
- Two SPF records. Adding a new service often means someone adds a second v=spf1 line instead of editing the first. Both then fail. Merge them into one.
- More than 10 DNS lookups. Each include:, a, mx and similar term costs a lookup, and includes can contain their own. Go past 10 and SPF returns a permanent error (RFC 7208 section 4.6.4). Long records from several marketing tools hit this limit quickly. The fix is to remove services you no longer use.
- ~all or -all. ~all marks unlisted senders as suspicious, -all rejects them. Many domains stay on ~all while they find every sender, then move to -all. Neither is a fault by itself. DMARC decides what happens to failures.
- SPF passes but does not line up. Some services send with their own bounce domain. SPF passes for that domain, but it does not match your From domain, so DMARC cannot count it. For those services DKIM has to carry the alignment.
- Forwarding breaks SPF. When a mailbox forwards mail to another address, the message arrives from the forwarder's server, which is not in the original sender's SPF. SPF fails even though nothing is wrong. DKIM signatures usually survive forwarding, which is one reason you need both.
- Old providers left in. An include: for a service you stopped using wastes lookups and keeps a sender authorised that should not be.
SPF record questions
What is an SPF record in simple terms?
It is a guest list for your domain. It names the servers and services allowed to send email as you, and receiving servers check it.
How many SPF records can a domain have?
One. If a domain publishes two, receivers cannot tell which to use and both fail. Combine every sender into the one record.
Should I use ~all or -all?
Either is valid. ~all is gentler and common while you are still finding senders. -all is stricter. Pair either with a DMARC record so failures are handled by policy.
Why does SPF fail when email is forwarded?
Forwarded mail comes from the forwarder's server, which your SPF record does not list. This is expected. DKIM usually still passes after forwarding.
Is SPF enough on its own?
No. It does not check the From address people see, and it breaks on forwarding. You need DKIM and DMARC as well.
Mail to Outlook.com says "SPF validation error". Do I add spf.protection.outlook.com again?
Check first. If your record already has it and is the only SPF record, adding it again changes nothing. Read the inner line of the bounce instead. See Emails to Outlook.com or Hotmail bouncing with a 550 error.
How long does an SPF change take?
Usually minutes to a few hours, depending on the record's TTL at your DNS host. Some receivers cache the old answer for longer.
How WaTo can help with this
Guides on this topic
- What is a DKIM record?
- What is a DMARC record?
- Emails to Outlook.com or Hotmail bouncing with a 550 error
- SPF, DKIM and DMARC in plain English
- Google Workspace emails going to spam? How to fix it
Sources & references
WaTo Consulting. Last reviewed 2026-11-09. Review when Google or Microsoft change their sender requirements.
Book a call
Not sure what is in your SPF record or why mail is being rejected? Book a call and have your domain name and any bounce message handy.
Mon to Fri, 8:30am to 5pm
