How to Set Up an SPF Record: Step-by-Step Guide

Step 1: Identify All Your Sending Sources

Before creating the record, list every service that sends email from your domain:

• Your primary email provider (Google Workspace, Microsoft 365, Zoho)
• Transactional email services (SendGrid, Mailchimp, Postmark, SES)
• Marketing tools (HubSpot, Klaviyo, Mailchimp)
• CRM tools that send automated emails
• Your own mail server if self-hosted

Missing a sending source means those emails may fail SPF checks.

Step 2: Build the SPF Record

Google Workspace

v=spf1 include:_spf.google.com ~all

Microsoft 365

v=spf1 include:spf.protection.outlook.com ~all

SendGrid

v=spf1 include:sendgrid.net ~all

Multiple providers

v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.10 ~all

Step 3: Choose Your All Mechanism

• -all — Hard fail: reject unlisted senders. Use once you are confident your record is complete.
• ~all — Soft fail: mark but accept unlisted senders. Safe starting point.
• ?all — Neutral: no policy. Provides no protection.
• Avoid +all — passes all senders, defeats the purpose.

Step 4: Publish the DNS Record

Add a TXT record at your domain root:

Most DNS control panels use @ to represent the root domain.

Step 5: Wait for Propagation and Verify

DNS changes typically propagate within minutes to hours. Then verify with our SPF Record Checker.

Common Mistakes to Avoid

• Publishing two SPF records (only one v=spf1 TXT record is allowed)
• Exceeding 10 DNS lookups (each include:, a, mx counts)
• Forgetting to add new sending services when they are onboarded