What Is an SPF Record? Examples, Limits and Setup

SPF is usually the first email record a small business adds and the first one to break, because every new tool that sends email for you, from a newsletter platform to a contact form, needs to be added to it. Here's how to read one, build one and avoid the limit that trips people up.

How to read an SPF record

Take Google's example and split it into its parts:

Part	What it means
v=spf1	This is an SPF record. Google says every SPF record starts with this tag
include:_spf.google.com	Google Workspace servers may send email for this domain
~all	Mark mail from any server not listed as spam

Google recommends using ~all at the end of your record. It tells receiving servers to treat mail from servers that aren't listed as spam rather than trusting it.

SPF record examples for common senders

Google's admin help publishes ready-made records for common services used alongside Google Workspace. A few of them:

If you also send through	Example SPF record from Google's help page
Mailchimp	v=spf1 include:_spf.google.com include:servers.mcsv.net ~all
Microsoft 365	v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all
Salesforce	v=spf1 include:_spf.google.com include:_spf.salesforce.com ~all
Shopify	v=spf1 include:_spf.google.com include:shops.shopify.com ~all
Zendesk	v=spf1 include:_spf.google.com include:mail.zendesk.com ~all

Notice the pattern: one record, one v=spf1 at the start, one ~all at the end, and an include for each service in between.

The 10 include limit

This is the insight most guides skip. Google says an SPF record can have up to 10 include tags. Growing businesses hit it without noticing: a mailbox, a newsletter tool, a CRM, a helpdesk, an invoicing app, a booking system and a couple of old tools nobody switched off. Before you add another include, remove services you no longer use. If you still need more, talk to your providers about sending from a subdomain with its own record.

Step 1: list everyone who sends email as you

Google's help page lists the usual suspects, and it's worth checking each one:

• Web servers, including your website's contact or order emails
• On-premise mail servers, such as Microsoft Exchange
• Mail servers run by your hosting provider
• Outbound gateways
• Services that send automatic email, such as Contact us forms
• Any third-party tool that sends email for your domain

Step 2 and 3: build the record and add it to your domain

1. Start with v=spf1.
2. Add an include for each sending service, using the domain your provider gives you.
3. Finish with ~all.
4. Go to the page where you update DNS TXT records at your domain host.
5. Add the record. If the host is your main domain rather than a subdomain, Google says enter the @ symbol in the host field.
6. Save, then repeat for any other domain you send from.

Google says it can take up to 48 hours for SPF authentication to start working, so don't panic if a checker shows the old result straight away.

Common SPF mistakes I see small businesses make

• Adding a second record for a new tool. When a new platform tells you to add SPF, add its include to your existing record rather than creating a separate one, so there's one list in one place.
• Forgetting the website. Order confirmations and contact form emails often come from your web host, not your mailbox, and they need to be in the record too.
• Leaving old tools in. A newsletter platform you cancelled two years ago still uses up one of your 10 includes.
• Copying a record from another business. An SPF record is a list of your own senders. Someone else's record lists theirs.
• Testing too soon. Google says changes can take up to 48 hours, so give it time before deciding it hasn't worked.

What happens when a message fails SPF

SPF on its own only tells the receiving server whether the sending server was on your list. With ~all at the end, Google's help page says mail from unlisted servers is marked as spam. What happens next depends on your DMARC record, if you have one: it tells receivers whether to deliver, quarantine or reject mail that fails, and sends you reports so you can spot a tool you forgot to add.

When you can skip SPF setup

Google says you don't need to set up SPF if your domain already has it by default, or if you bought your domain from a Google partner when you signed up for Google Workspace. Check first with a free DNS lookup tool. You also don't need to change anything in the Google Admin console: SPF is added at your domain host.

Why SPF on its own isn't enough any more

Google's email sender guidelines say every sender to personal Gmail accounts must set up SPF or DKIM, and anyone sending more than 5,000 messages a day must set up SPF, DKIM and DMARC. Bulk senders also need the From domain to match the SPF or DKIM domain, and Gmail asks all senders to keep spam rates reported in Postmaster Tools below 0.3%. So treat SPF as the first of three records, with DKIM and DMARC to follow. If your emails are still struggling, this guide to the spam folder covers the content side.

My verdict

Keep one SPF record, keep it tidy and review it every time you add or drop an email tool. If your newsletters are still landing in spam after all three records are in place, the problem is more likely your list or your content, and my guide on why newsletters land in spam is the next place to look.

Frequently asked questions

What is an SPF record used for?

It lists the servers allowed to send email for your domain, so receiving servers can check a message came from an authorised source.

What SPF record should I use for Google Workspace?

If you only send through Google Workspace, Google's recommended record is v=spf1 include:_spf.google.com ~all.

How many includes can an SPF record have?

Google says an SPF record can have up to 10 include tags.

How long does an SPF record take to work?

Google says it can take up to 48 hours for SPF authentication to start working.

Should SPF end in ~all or -all?

Google recommends ~all, which tells receiving servers to mark mail from unlisted servers as spam.