Understanding SPF Records

Learn how SPF records help protect your domain from email spoofing and phishing attacks.

What is an SPF Record?

An SPF (Sender Policy Framework) record is a type of DNS TXT record that tells email servers which mail servers are allowed to send email on behalf of your domain. It helps prevent spammers and attackers from sending emails that appear to come from your domain (a technique called spoofing).

Format:

example.com.    IN    TXT    "v=spf1 include:_spf.google.com ~all"

Examples:

# Allow only Google Workspace to send email
example.com.    IN    TXT    "v=spf1 include:_spf.google.com ~all"

# Allow Microsoft 365 and Google Workspace
example.com.    IN    TXT    "v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all"

# Block all email (domain does not send email)
example.com.    IN    TXT    "v=spf1 -all"

Simple Explanation

Think of an SPF record like a guest list for a party:

Only the mail servers on the list are allowed to send email for your domain
If a server not on the list tries to send email, it will be marked as suspicious or rejected
This helps keep out unwanted or fraudulent emails that pretend to be from you

Key Components

•
v=spf1
This tag identifies the record as an SPF record and must always be at the start.
•
include:
Lets you include other domains' SPF records (e.g., your email provider's servers).
•
~all / -all
~all means "soft fail" (not authorized, but not strictly blocked). -all means "hard fail" (strictly block unauthorized senders).

Common Configurations

Google Workspace

v=spf1 include:_spf.google.com ~all

Microsoft 365

v=spf1 include:spf.protection.outlook.com -all

Block All Email

v=spf1 -all

Common Mistakes

⚠️
Multiple SPF Records
You should only have one SPF record per domain. Having more can cause email delivery problems.
⚠️
Forgetting to Update SPF When Adding New Services
If you add a new email service (like a marketing platform), update your SPF record to include it.
⚠️
Using the Wrong Qualifier
~all is more forgiving, -all is stricter. Choose based on your needs.

Best Practices

✓
Keep It Simple
Only include the services you actually use to send email.
✓
Test Your SPF Record
Use online tools to check your SPF record for errors and make sure it's working as expected.
✓
Use -all for Strict Security
If your domain should never send email, use v=spf1 -all to block all unauthorized senders.

Security Considerations

🔒
Combine with DKIM and DMARC
SPF is just one part of email authentication. For best protection, also set up DKIM and DMARC records.
🔒
Monitor for Abuse
Regularly check your domain for unauthorized use and update your SPF record as needed.

Learn More

Beep beep... Loading...