SPF Record (Sender Policy Framework)

An SPF record is a DNS TXT record that lists the servers allowed to send email for a domain. SPF stands for Sender Policy Framework. When a message arrives, the receiving server finds the domain in the message’s Return-Path, looks up that domain’s SPF record, and checks whether the sending server’s IP address is on the list. SPF works alongside DKIM and DMARC.

SPF record example and syntax

Here is a record for acme.com, a company that sends from Google Workspace and a Zendesk help desk. It is a single TXT record at the root of the domain, which most DNS editors show as @.

Each term after v=spf1 is a mechanism. The receiving server checks them from left to right and stops at the first one that matches the sending IP. ip4 and ip6 match addresses directly. include looks up another domain’s SPF record and matches if that record would pass. a and mx match the addresses in the domain’s own A or MX records. The all at the end matches every server that is left, and the symbol in front of it sets the result.

A -all fail can lead some receivers to reject a message during the SMTP session, before they check DKIM. RFC 7489 describes this, and it is why many domains keep ~all and let DMARC decide what happens to failing mail.

How to add or edit an SPF record

1. List every service that sends mail with your domain in the Return-Path: your mailbox provider, help desk, CRM, billing tool, and any server you run. Services that use a Return-Path host of their own, like Loops, get a separate record instead.

2. Find each service’s SPF value in its setup docs. Most give you an include: term. Google Workspace’s is include:_spf.google.com.

3. In your DNS provider, open the records for the domain and look for a TXT record at the root (shown as @ or a blank name) that starts with v=spf1. If one exists, edit it. Only create a new record if there isn’t one.

4. Write one record: v=spf1, then each term separated by a space, then one all term at the end. Save it as type TXT. The old SPF record type is deprecated.

5. Wait for DNS to update, then look the domain up in the email DNS checker. Send a test message to a mailbox you control and look for spf=pass in its Authentication-Results header.

Cloudflare, GoDaddy, Namecheap and Route 53 label the fields differently (Name, Host or Record name), but the record is the same in each: type TXT, the root host, and a value that starts with v=spf1. Route 53 expects the value wrapped in double quotes. DNS changes usually show up within a few hours and can take up to 72.

The 10-lookup limit

SPF allows at most 10 terms that trigger DNS lookups in a single check (RFC 7208, section 4.6.4). include, a, mx, ptr, exists and redirect count. ip4, ip6 and all don’t. Lookups inside an included record count toward the same 10, so an include that pulls in three more includes uses four.

Past 10, the check returns permerror, and DMARC treats that as SPF not passing. The RFC also suggests failing after two lookups that return nothing, which catches includes left behind by services you no longer use.

To get back under the limit:

• Remove includes for services that no longer send for you.

• Drop a and mx unless your own web or mail servers send email. Many records carry them over from a template.

• Give a service its own Return-Path subdomain if it supports one. That record is checked on its own, with a separate budget of 10. Loops works this way.

• Remove ptr. RFC 7208 says not to publish it.

• Be careful with flattening, which swaps includes for the provider’s current IP ranges. It saves lookups but breaks when the provider changes its ranges, unless a tool keeps the list updated.

To count, look up the record in the email DNS checker, then count the lookup terms in it and in each record it includes.

Common SPF errors

• Two SPF records at one host. A second TXT record that starts with v=spf1 at the same name makes every check return permerror. Merge them: v=spf1 include:_spf.google.com ~all and v=spf1 include:mail.zendesk.com ~all become v=spf1 include:_spf.google.com include:mail.zendesk.com ~all. Other TXT records, such as domain verification codes, can stay.

• Too many lookups. More than 10 lookup terms, counting nested includes, also returns permerror.

• A neutral or open ending. ?all tells receivers nothing about unlisted servers, and +all lets anyone send as you. Use ~all or -all.

• A missing ending. A record with no all term ends as if it said ?all.

• The record is on the wrong host. SPF checks the Return-Path domain, not the From address. If a service sends with a Return-Path of its own, adding its include to your root record does nothing for that mail.

• Syntax slips. A missing space between terms, a typo in v=spf1, or terms placed after all, which are never checked. A long record split into several quoted strings is still one record, so that part is fine.

How SPF works with DKIM and DMARC

SPF checks the server that sent a message. DKIM checks the message itself: the sender signs it, and the receiver verifies the signature against a public key in DNS. DMARC connects both to the From address people see. A message passes DMARC when SPF or DKIM passes for a domain that aligns with the From domain. The DMARC record then tells receivers what to do with mail that doesn’t.

Forwarding is the main reason SPF can’t work alone. Google and Yahoo require SPF, DKIM and a DMARC record from bulk senders. Use the DMARC record generator to write your policy, and the email deliverability guide for the rest of the checklist.

What Loops sets up for your domain

When you add a sending domain in Loops, ideally a subdomain such as mail.acme.com, the Settings → Domain page lists the records to add: SPF, DKIM, MX and DMARC. Copy each one into your DNS provider, or import the zone file Loops gives you, then click Verify Records.

Loops puts its SPF record on the envelope subdomain of your sending domain, with an MX record on the same host. That host is the Return-Path for mail Loops sends, so receivers check SPF there and don’t read your root record for that mail. You don’t add Loops to your existing SPF record, and it doesn’t use any of your root record’s 10 lookups.

Loops signs every message with DKIM from your first send. The DMARC record Loops gives you uses relaxed alignment, so the envelope subdomain and the DKIM signature both line up with your From domain. If you also send from Google Workspace or another service, keep your root SPF record as it is. The email DNS checker looks up SPF at both the root and the envelope host.

The steps for each DNS provider are in Setting up your domain, and DMARC and DKIM setup covers what Loops provides and what you add.

FAQ

What is an SPF record?
An SPF record is a DNS TXT record that lists the servers allowed to send email for a domain. Receiving servers compare the sending server’s IP address with the SPF record of the domain in the Return-Path.

How does SPF work?
The domain owner publishes the record. When mail arrives, the receiving server reads the Return-Path domain, looks up its SPF record, and checks the sending IP against it. The result is pass, fail, softfail, neutral, none, or an error.

What is the difference between ~all and -all?
~all asks receivers to treat unlisted servers as a softfail, and -all as a fail. Some receivers reject on fail before they check DKIM, so many domains keep ~all and let their DMARC policy decide.

Can a domain have two SPF records?
No. Two TXT records that start with v=spf1 at the same host make SPF return permerror. Merge them into one record with one v=spf1 and one all term.

What happens if an SPF record needs more than 10 DNS lookups?
The check returns permerror, and DMARC treats that as SPF not passing. Remove unused includes, drop a and mx if your own servers don’t send email, or move a service to its own Return-Path subdomain.

Do I need to add Loops to my SPF record?
No. Loops gives you an SPF record on the envelope subdomain of your sending domain, such as envelope.mail.acme.com. That host is the Return-Path for mail Loops sends, so your root SPF record stays as it is and keeps all 10 of its lookups.

Is SPF enough to stop spoofing?
No. SPF doesn’t check the From address people see, and it usually fails when mail is forwarded. Publish DKIM and a DMARC policy alongside it.

Related: DKIM, DMARC, Email authentication, Email deliverability best practices, Inbox placement, Sender reputation.