How to fix your SPF record

SPF lists the servers allowed to send mail for your domain. Receivers look it up on the domain in the envelope sender (Return-Path).

1. Publish exactly one SPF record

SPF is a TXT record at the domain itself (not a subdomain) that starts with v=spf1. Two SPF records on the same name is an error (permerror), so merge them into one.

example.com.  TXT  "v=spf1 include:spf.protection.outlook.com -all"

Common includes: Microsoft 365 include:spf.protection.outlook.com, Google Workspace include:_spf.google.com. Your newsletter, CRM or helpdesk provider documents its own. A domain using both Microsoft 365 and Google:

example.com.  TXT  "v=spf1 include:spf.protection.outlook.com include:_spf.google.com -all"

2. Stay within 10 DNS lookups

Each include, a, mx, ptr, exists and redirect costs a lookup, and includes count the lookups inside them too. More than 10 is a permerror and SPF fails for every message. At most 2 of them may return nothing (void lookups). To get back under the limit:

• Remove includes for services you no longer use.
• Replace a and mx with the fixed addresses they stand for, as ip4: and ip6:, when those addresses do not change.
• Send bulk mail from a subdomain (for example news.example.com) with its own SPF record.

Do not use ptr: the SPF standard (RFC 7208) says not to, and some receivers ignore it.

3. End with -all or ~all, never +all

-all says other servers are not allowed. ~all (softfail) says they are probably not. Once DMARC is at p=quarantine or p=reject, DMARC decides what happens to failing mail, so ~all is fine there. +all and ?all let anyone send as you.

4. Domains that send no mail

parked.example.  TXT  "v=spf1 -all"

Pair it with a DMARC record at p=reject (see the DMARC guide) and, if the domain receives no mail either, a null MX: parked.example. MX 0 .

5. Check what is published

dig +short TXT example.com