SPF record examples
; Google Workspace only
example.com. TXT "v=spf1 include:_spf.google.com ~all"
; Microsoft 365 only (Microsoft recommends -all)
example.com. TXT "v=spf1 include:spf.protection.outlook.com -all"
; a server of your own plus Google Workspace
example.com. TXT "v=spf1 ip4:203.0.113.25 include:_spf.google.com ~all"
; a self-hosted mail server that sends from its MX host
example.com. TXT "v=spf1 mx -all"
; a domain that sends no mail at all
example.org. TXT "v=spf1 -all"The record goes on the domain itself — @ in most DNS panels — as a TXT record. A domain has exactly one; to add a service, add its include to the record you have. The SPF checker reads the published record and resolves every include it pulls in.
Includes of common providers
The include each provider documents for mail sent with your domain in the envelope, and the DNS lookups it cost in all on 12 October 2026. Providers change their records without notice, so the count is a guide, not a promise.
| Provider | Include | Lookups |
|---|---|---|
| Google Workspace | include:_spf.google.com | 1 |
| Microsoft 365 | include:spf.protection.outlook.com | 1 |
| Zoho Mail | include:zoho.com | 5 |
| Proton Mail | include:_spf.protonmail.ch | 2 |
| Fastmail | include:spf.messagingengine.com | 1 |
| iCloud+ custom domain | include:icloud.com | 5 |
| Mailgunon the domain you send from — often a subdomain such as mg.example.com | include:mailgun.org | 5 |
| Amazon SESonly on a custom MAIL FROM subdomain; with SES's own MAIL FROM no SPF change is needed | include:amazonses.com | 1 |
| SendGridonly with automated security turned off; with it on, SendGrid's return-path subdomain carries SPF | include:sendgrid.net | 2 |
| Zendesk | include:mail.zendesk.com | 1 |
| Salesforce | include:_spf.salesforce.com | 2 |
Newsletter and transactional services that bounce through a domain of their own — the default at most of them — need no include on your domain at all: SPF passes for their bounce domain, and DMARC then relies on the DKIM signature they add for your domain. An include for such a service only costs lookups.
The limit of ten lookups
| Term | Matches | Lookups |
|---|---|---|
| ip4:203.0.113.0/24 | An IPv4 address or network | 0 |
| ip6:2001:db8::/48 | An IPv6 address or network | 0 |
| a | The domain's own A and AAAA addresses | 1 |
| mx | The addresses of the domain's MX hosts | 1 |
| include:… | Whatever the other domain's SPF record allows | 1 + its own |
| exists:… | A lookup built from macros, used by some large senders | 1 |
| redirect=… | Another domain's record instead of this one; ignored when the record has an all | 1 |
| ptr | Reverse DNS — RFC 7208 says not to use it | 1 |
| ~all, -all | Everything not matched | 0 |
A receiver may make at most ten lookups while evaluating one record (RFC 7208, section 4.6.4), counting the ones inside every include; on the eleventh the result is permerror, which most receivers treat as a fail. The generator counts the record’s own terms and adds the listed providers’ costs. To get under ten: list your own servers as ip4:/ip6: instead of a and mx, remove includes of services you no longer use, and move bulk mail to a subdomain with its own record.
Records longer than 255 characters
One TXT string holds 255 characters. A longer SPF record is still one record, published as several quoted strings that receivers join without adding a space (RFC 7208, section 3.3) — so a cut in the middle of a word is fine, and a space at the end of one string must not be lost. Most DNS panels split a long value for you; in a zone file you write the strings yourself, as the zone-file line above does. RFC 7208 also asks to keep the whole TXT answer under about 450 bytes, other TXT records at the name included, so that it fits a single UDP packet.
dig example.com TXT +short | grep spf1 # what is published
dig _spf.google.com TXT +short # follow an includeSPF covers only the envelope sender. For mail to pass DMARC — what Gmail and Yahoo ask of bulk senders — the domain also needs DKIM and a DMARC record: the DMARC record generator writes that one, and the mail server check shows all of it together.
Frequently asked
What should my SPF record contain?
Every server that sends mail with your domain as the envelope sender: your mailbox provider's include, the IP addresses of servers you run yourself (ip4: and ip6:), your MX hosts if they also send, and services such as a help desk that send as you — then ~all or -all at the end. Newsletter and transactional services that bounce through their own domain, as most do by default, need no include: they need DKIM signing for your domain instead.
Should my SPF record end in ~all or -all?
Once a DMARC policy is enforced, both stop spoofing, because DMARC decides what happens to failing mail. ~all (soft fail) is the common choice and is gentler on forwarded mail at receivers without DMARC; -all (fail) lets those receivers reject outright, and Microsoft recommends it for Microsoft 365 domains. Never publish +all, which allows every server on the internet, and do not leave ?all in place — it protects nothing.
How many includes can an SPF record have?
There is no limit on includes as such, but evaluating a record may take at most ten DNS lookups (RFC 7208). Each include, a, mx, exists and redirect costs one, and the lookups inside an included record count too: on 12 October 2026 Google Workspace's include cost one lookup in all and Zoho Mail's five. On the eleventh the result is permerror. The generator counts the record's own lookups and adds what the listed providers cost; the SPF checker resolves every include after you publish.
My SPF record is longer than 255 characters. Is that a problem?
Not as long as it stays one record. A single TXT string holds 255 characters, so a longer record is published as several quoted strings in the same record, which receivers join without adding a space — most DNS panels split it for you, and the zone-file line here shows the split. Keep the whole TXT answer under about 450 bytes, as RFC 7208 advises, so that it fits one UDP packet.
How do I add a new mail service to my SPF record?
Add its include: to your existing record, before the all — never publish a second v=spf1 record, because two records make every SPF check fail with permerror. Paste your current record into the generator, tick the service or type its include, and copy the result. Check the lookup count with the SPF checker once it is published.