Authentication
How to Read and Write an SPF Record
Quick Answer
An SPF record is a single TXT record starting with "v=spf1", followed by mechanisms like "include:" (authorize another provider) and ending with a qualifier like "-all" (strict) or "~all" (soft fail) defining what happens for unlisted senders.
SPF syntax looks dense but follows a consistent, readable pattern once you know what each piece represents.
Common Causes
- Not recognizing that "include:" statements pull in another provider's entire list of authorized servers.
- Using "-all" (hard fail) before confirming every legitimate sender is included, causing real mail to be rejected.
- Exceeding the 10 DNS lookup limit by including too many third-party services.
Safe Troubleshooting Steps
- Start with "v=spf1" - this identifies the record as SPF version 1.
- Add "include:_spf.google.com" for Google Workspace mail.
- Add an "include:" for each additional service that sends mail as your domain (marketing tools, invoicing, etc.).
- End with a qualifier: "~all" (soft fail, safer while testing) or "-all" (hard fail, stricter) depending on confidence in the list.
What to Verify
- The record starts with "v=spf1" and there is only one SPF record for the domain.
- Every legitimate sending service has a matching "include:".
- Total DNS lookups triggered stay under SPF's limit of 10.
When Professional Help May Be Useful
If you are not sure which third-party services need to be included, or the lookup count is close to the limit, a review of your full sending landscape helps avoid breaking mail from a service you forgot about.