What an SPF record looks like
An SPF record is a TXT entry on the domain that starts with v=spf1. It lists the permitted senders and ends with a rule for everyone else.
example.org. IN TXT "v=spf1 mx include:_spf.google.com ip4:203.0.113.25 -all"The main building blocks
- mx: the servers in the domain's MX records.
- a: the IP address of the domain itself.
- ip4: and ip6: single addresses or networks.
- include: the SPF list of a service such as your mail provider or newsletter tool.
- -all rejects everyone else, ~all marks them as suspicious (softfail).
Common mistakes
- Two SPF records on the same domain. Exactly one may exist, otherwise the result is an error.
- More than 10 DNS lookups. include, a, mx, ptr, exists and redirect all count; exceeding the limit produces a permanent error.
- A sending service is missing from the list, such as the newsletter tool or the contact-form server.
- +all at the end allows every server to send and makes the record worthless.
~all or -all?
Start with ~all while you are unsure that every sender is on the list. Once DMARC reports show no unknown sources, switch to -all.
What SPF cannot do
SPF checks the envelope address (Return-Path) and breaks on forwarding. For DMARC, that address has to match the visible From domain (alignment). DKIM covers exactly those gaps.