How to Add an SPF Record: 7 Proven Easy Steps

How to Add an SPF Record is an essential skill for website owners, developers, freelancers, and IT administrators who use a custom domain for business email. An SPF record helps receiving mail servers identify which systems are authorized to send email using your domain.

If your domain is example.com and you send emails through Google Workspace, Microsoft 365, your hosting server, or a third-party email marketing platform, those sending services should be properly represented in your email authentication setup.

Learning How to Add an SPF Record involves creating or updating a DNS TXT record for your domain. The process is simple once you understand where DNS is managed and which email services actually send messages on behalf of your domain.

In this beginner-friendly tutorial, you will learn How to Add an SPF Record step by step. We will cover what SPF is, why it matters, how to find your DNS provider, how to create an SPF record, how to add multiple email providers, how to test SPF, common mistakes, and important security best practices.

What Is an SPF Record?

Before learning How to Add an SPF Record, it is important to understand what SPF means.

SPF stands for Sender Policy Framework. It is an email authentication mechanism that allows a domain owner to publish information about which mail servers are authorized to send email using the domain.

An SPF policy is published in DNS as a TXT record.

For example:

v=spf1 include:example-mail-provider.com ~all

This record tells receiving systems that the domain’s SPF policy includes the specified email provider and uses a soft-fail policy for other senders.

The official IETF SPF specification defines SPF as a mechanism for authorizing hosts to use a domain for email identities.

Understanding this basic concept makes How to Add an SPF Record much easier.

Why Should You Add an SPF Record?

Learning How to Add an SPF Record is important for several reasons.

Help Prevent Email Spoofing

Email spoofing occurs when an unauthorized sender attempts to make an email appear to come from your domain.

SPF gives receiving mail servers an additional way to evaluate whether the sending server is authorized.

Improve Email Authentication

SPF is one component of a broader email authentication strategy that can also include DKIM and DMARC.

Google recommends authenticating domains with SPF and DKIM and using appropriate email authentication practices.

Support Email Deliverability

If legitimate email services are missing from your SPF policy, messages sent through those services may have authentication problems and can be more likely to be marked as spam.

Google specifically recommends that SPF records include all email senders used by your domain.

Protect Your Business Domain

If you use your domain for business communication, configuring SPF is an important part of maintaining a trustworthy email infrastructure.

This is why understanding How to Add an SPF Record is useful even for beginners.

How Does SPF Work?

Before learning How to Add an SPF Record, it helps to understand the basic SPF process.

Suppose you use:

example.com

Your company sends an email from an authorized mail server.

The receiving mail server can check the SPF record published by example.com.

The simplified process looks like this:

Your Domain
     ↓
SPF TXT Record
     ↓
Authorized Email Server
     ↓
Email Sent
     ↓
Receiving Mail Server
     ↓
SPF Check
     ↓
Pass / Fail / SoftFail / Neutral

The receiving system compares the sending information against the SPF policy.

This does not mean SPF alone guarantees that an email is legitimate. SPF is one part of email authentication and should normally be combined with DKIM and DMARC.

SPF Record vs SPF TXT Record

A common beginner question when learning How to Add an SPF Record is whether SPF has its own DNS record type.

Modern SPF records are published as TXT records.

The official SPF specification states that SPF records must be published as DNS TXT records.

You will therefore normally create:

Type: TXT

rather than looking for an SPF record type in your DNS control panel.

A typical record may look like:

Host: @
Type: TXT
Value: v=spf1 include:example.com ~all

The exact value depends on your email provider.

What Do You Need Before Adding an SPF Record?

Before starting How to Add an SPF Record, identify every service that sends email using your domain.

For example, your company may use:

Google Workspace → Employee email
Microsoft 365 → Employee email
Mailchimp → Marketing email
SendGrid → Transactional email
Website server → Contact form email

You need to know which of these services actually sends messages using your domain.

Make a simple list:

Email Provider 1
Email Provider 2
Marketing Platform
Website/Application

Then check each provider’s official SPF instructions.

Do not copy SPF values from another website because SPF records are specific to your email infrastructure.

Step 1: Find Your DNS Provider

The first practical step in How to Add an SPF Record is finding where your domain’s DNS records are managed.

Your domain registrar and DNS provider may be different.

For example:

Domain Registrar → Company A
DNS Provider → Cloudflare
Website Hosting → Company B
Email Provider → Google Workspace

In this example, the SPF record must be added to the DNS zone managed by Cloudflare.

Look for options such as:

DNS Management
Manage DNS
DNS Records
Zone Editor
DNS Zone

You should see records such as:

A
AAAA
CNAME
MX
TXT

If you cannot find DNS management in your hosting account, check your domain’s nameservers.

Step 2: Check Whether an SPF Record Already Exists

Before learning How to Add an SPF Record, always check for an existing SPF record.

This is one of the most important steps.

Open your DNS management panel and look for a TXT record beginning with:

v=spf1

For example:

v=spf1 include:_spf.example.com ~all

If you already have an SPF record, do not create another SPF record for the same domain.

The SPF specification does not permit multiple records that cause more than one SPF record to be selected for the same domain. Multiple SPF records can result in a permanent error during SPF evaluation.

Instead, update the existing SPF record.

Step 3: Identify Your Email Provider’s SPF Value

The next step in How to Add an SPF Record is finding the SPF value provided by your email service.

For example, an email provider might tell you to add:

include:example-email.com

Another provider might use a different value.

For Google Workspace, a commonly used SPF mechanism is:

include:_spf.google.com

However, always check Google’s current documentation and your organization’s actual email configuration before publishing it.

Google provides guidance for setting up SPF and recommends including all legitimate email senders for your domain.

Third-party providers may instead give you values such as:

include:spf.example-provider.com

or an IP address:

ip4:203.0.113.10

Use only the values documented by the service you actually use.

Step 4: Create the SPF TXT Record

Now you can add the SPF record.

Open your DNS management panel and click Add Record.

Select:

Type: TXT

For the host or name, many DNS providers use:

@

This generally represents the root domain.

Then enter the SPF value.

For example:

v=spf1 include:_spf.google.com ~all

A simplified configuration might look like:

Host: @
Type: TXT
Value: v=spf1 include:_spf.google.com ~all

Your exact SPF record may be different.

Do not use this example automatically if you do not use Google Workspace.

The correct approach to How to Add an SPF Record is to use the authorization mechanisms supplied by your actual email providers.

Understanding the Parts of an SPF Record

To understand How to Add an SPF Record, you should know what the different parts mean.

Consider:

v=spf1 include:_spf.google.com ~all

v=spf1

This identifies the SPF version.

v=spf1

is the required SPF version identifier for the standard described by RFC 7208.

include

The include mechanism tells the receiving system to evaluate another domain’s SPF policy as part of the authorization process.

For example:

include:_spf.google.com

This is commonly used by email providers to authorize their infrastructure.

~all

The ~all mechanism produces a softfail result for senders that do not match the preceding mechanisms.

SPF also supports other qualifiers.

Understanding -all, ~all, ?all, and +all

One of the most important parts of How to Add an SPF Record is understanding the final all mechanism.

-all

Example:

v=spf1 include:example.com -all

This indicates that hosts not authorized by the preceding mechanisms should produce an SPF fail result.

~all

Example:

v=spf1 include:example.com ~all

This indicates a softfail for unauthorized senders.

?all

Example:

v=spf1 include:example.com ?all

This indicates a neutral result for senders that do not match.

+all

Example:

v=spf1 +all

This effectively authorizes all senders and defeats the purpose of using SPF to restrict sending sources.

Do not use +all as a way to solve SPF problems.

The SPF specification defines the qualifiers and their resulting evaluation behavior.

Step 5: Add Multiple Email Providers to One SPF Record

Many businesses use more than one service to send email.

For example:

Google Workspace
+
Marketing Platform
+
Transactional Email Provider

You should normally combine the legitimate authorization mechanisms into one SPF record.

For example:

v=spf1 include:_spf.google.com include:spf.example-mail.com ~all

The exact values depend on your providers.

Do not create:

TXT → v=spf1 include:_spf.google.com ~all

and another:

TXT → v=spf1 include:spf.example-mail.com ~all

for the same domain.

Instead, combine the required mechanisms into a single SPF policy where appropriate.

This is a critical rule when learning How to Add an SPF Record.

Step 6: Add an IP Address to Your SPF Record

If your website or mail server sends email directly from a known IP address, your SPF provider may tell you to authorize that IP.

For an IPv4 address, the syntax is:

ip4:203.0.113.10

For example:

v=spf1 ip4:203.0.113.10 ~all

For IPv6, the syntax uses:

ip6:

For example:

v=spf1 ip6:2001:db8::1 ~all

Only add IP addresses that are actually authorized to send mail for your domain.

Adding an unrelated IP does not improve security.

Step 7: Save the SPF Record and Wait for DNS Updates

After entering the record, save your DNS changes.

The DNS provider may display a confirmation message.

Your SPF record might eventually look like:

example.com. TXT "v=spf1 include:_spf.google.com ~all"

DNS changes may not become visible everywhere immediately.

Caching and TTL values affect how quickly DNS resolvers see updated information.

Do not repeatedly change the record just because an external checker does not immediately show the update.

Waiting and verifying the authoritative DNS zone are important parts of How to Add an SPF Record.

How to Verify an SPF Record

After completing How to Add an SPF Record, verify that the record is publicly available.

You can use DNS lookup tools or command-line utilities.

Using dig

On Linux or macOS, you can run:

dig TXT example.com

Look for a result containing:

v=spf1

You can also use:

dig +short TXT example.com

Using nslookup

On Windows, you can use:

nslookup -type=TXT example.com

Then look for the SPF record.

You can also use reputable online DNS lookup tools.

The important thing is to verify the public DNS record rather than relying only on what your DNS dashboard displays.

How to Test SPF With a Real Email

Another useful part of How to Add an SPF Record is testing actual email delivery.

Send a message from your domain to an external mailbox.

Open the message’s full headers or original message.

Look for authentication information.

You may see something similar to:

spf=pass

A successful SPF result indicates that the receiving server’s SPF evaluation accepted the sending host under the applicable SPF policy.

The exact header format depends on the receiving email provider.

How to Add an SPF Record for Google Workspace

If your organization uses Google Workspace, Google provides specific SPF instructions.

The basic concept is to authorize Google’s mail servers through the appropriate SPF mechanism.

A commonly used Google Workspace SPF value is:

v=spf1 include:_spf.google.com ~all

However, if your organization also uses other legitimate email services, the final record needs to account for those services as well.

Google recommends that the SPF record for your domain include all email senders for your domain.

Before making changes, check Google’s current official email sender guidelines and your organization’s actual sending configuration.

How to Add an SPF Record for Microsoft 365

Microsoft 365 provides its own SPF configuration instructions.

A common Microsoft 365 SPF mechanism is:

include:spf.protection.outlook.com

A basic Microsoft 365 example may therefore look like:

v=spf1 include:spf.protection.outlook.com -all

However, do not use this example blindly.

If your organization also sends email through another platform, that service must be considered.

Follow Microsoft’s current official guidance for your tenant and email configuration.

[Internal link: How to Add DKIM and DMARC Records]

How to Add an SPF Record in cPanel

If your DNS is managed through cPanel, you may be able to add an SPF record using the Zone Editor.

Log in to cPanel.

Go to:

Domains → Zone Editor

Select your domain.

Click Manage if necessary and then choose Add Record.

Select:

Type: TXT

For the name, use:

@

if your cPanel DNS interface uses @ for the root domain.

Enter the SPF value provided by your email service.

For example:

v=spf1 include:example-mail-provider.com ~all

Then save the record.

The exact cPanel interface may differ depending on your hosting provider.

How to Add an SPF Record in Cloudflare

If Cloudflare manages your DNS, log in to your Cloudflare account and select your domain.

Open the DNS section.

Choose Add record.

Select:

Type: TXT

Enter:

Name: @

Then enter your SPF policy in the content field.

For example:

v=spf1 include:example-mail-provider.com ~all

Save the record.

Remember that Cloudflare is only an example DNS provider. Your authoritative DNS provider may be different.

SPF and Email Marketing Services

Many businesses use email marketing services such as newsletter platforms.

If a marketing platform sends messages using your domain, it may provide an SPF include value.

For example:

include:spf.marketing-provider.example

Add the provider’s documented mechanism to your SPF policy.

Do not simply add every email service you have an account with.

The important question is:

Does this service actually send email using my domain?

If it does, review its authentication requirements.

If it does not send mail on your behalf, it may not belong in your SPF record.

SPF and Transactional Email Services

Applications often send:

• Password reset emails
• Order confirmations
• Account verification emails
• Contact form notifications
• Invoice emails
• Shipping notifications

These messages may be sent through a transactional email provider.

If the provider uses your domain as the sending domain, follow its SPF setup instructions.

For example, a provider may give you:

include:spf.transactional-example.com

Your final SPF policy could contain multiple authorized services:

v=spf1 include:_spf.google.com include:spf.transactional-example.com ~all

The actual record should be based on your email infrastructure.

The SPF 10 DNS Lookup Limit

One of the most important technical concepts in How to Add an SPF Record is the SPF DNS lookup limit.

SPF implementations must limit certain DNS-causing mechanisms and modifiers to a total of 10 DNS lookups during evaluation.

The mechanisms and modifier that can cause these lookups include:

• include
• a
• mx
• ptr
• exists
• redirect

If the evaluation exceeds the limit, the SPF result can become a permerror.

This becomes a problem for organizations using many email services.

For example, a record with numerous include mechanisms can indirectly trigger many additional DNS lookups because each included policy can contain more mechanisms.

Therefore, simply adding every provider’s SPF include is not always the best solution.

How to Avoid SPF Too Many DNS Lookups Errors

If your SPF record exceeds the lookup limit, you may see errors such as:

SPF PermError
Too many DNS lookups
SPF exceeds 10 DNS lookups

Possible approaches include:

• Remove unused email services
• Remove unnecessary mechanisms
• Review nested include records
• Consolidate email services
• Use provider-recommended SPF optimization
• Consider an SPF flattening service where appropriate

Do not manually copy every IP address from a provider’s SPF record without understanding the maintenance implications.

If the provider changes its infrastructure, a manually flattened SPF record can become outdated.

The official SPF specification recommends minimizing the DNS information required to evaluate an SPF record.

Common SPF Errors and How to Fix Them

When learning How to Add an SPF Record, several mistakes appear frequently.

Multiple SPF Records

You may accidentally create:

TXT: v=spf1 include:provider1.com ~all

and:

TXT: v=spf1 include:provider2.com ~all

for the same domain.

Instead, combine the legitimate mechanisms into one SPF record.

SPF Record Not Found

Check:

• DNS provider
• Domain name
• Record type
• Host/name
• Whether the record was saved
• DNS propagation

SPF Syntax Error

Make sure the record starts with:

v=spf1

and that mechanisms are correctly separated by spaces.

Legitimate Emails Fail SPF

If legitimate email fails SPF, identify which service sent the message.

Then check whether its authorized mechanism or IP is included in the SPF record.

Too Many DNS Lookups

Review all include, a, mx, ptr, exists, and redirect mechanisms.

Remember that nested includes can contribute to the overall lookup count.

Wrong Domain

SPF applies to the domain being evaluated for the email’s relevant identity. Make sure you are publishing the policy on the correct domain or subdomain.

SPF and Subdomains

Another important concept in How to Add an SPF Record is subdomains.

For example:

example.com
mail.example.com
news.example.com

These can have different DNS configurations.

If a subdomain is used as an email identity, its SPF behavior needs to be considered separately according to how the email system is configured.

Do not assume that changing the root domain’s SPF record automatically solves every possible subdomain email authentication scenario.

Review your email provider’s documentation if you send mail from multiple subdomains.

SPF, DKIM, and DMARC Together

SPF works best as part of a broader email authentication strategy.

A common setup is:

SPF
 ↓
DKIM
 ↓
DMARC
 ↓
Email Authentication

SPF

SPF identifies authorized sending infrastructure.

DKIM

DKIM uses a cryptographic signature to authenticate messages.

DMARC

DMARC allows a domain owner to publish a policy and use SPF and/or DKIM authentication with domain alignment.

[Internal link: How to Add DKIM and DMARC Records]

Using these technologies together provides a stronger email authentication framework than relying on SPF alone.

SPF Security Best Practices

After learning How to Add an SPF Record, follow these best practices.

Keep One SPF Record

Avoid publishing multiple SPF policies for the same domain.

Include Only Legitimate Senders

Do not authorize email services that do not send messages for your domain.

Avoid +all

Never use +all simply to make SPF pass.

Monitor Your Email Infrastructure

Keep track of every platform that sends email for your domain.

Review Third-Party Services

Marketing, CRM, support, transactional, and website systems may all have different email authentication requirements.

Protect DNS Access

Use strong passwords and multi-factor authentication for your DNS account when available.

Review Changes Before Publishing

An incorrect SPF record can cause legitimate messages to fail authentication.

Common Mistakes Beginners Should Avoid

When learning How to Add an SPF Record, avoid these mistakes.

Creating Two SPF Records

Use one SPF policy per domain.

Copying Another Company’s SPF Record

Every domain has different authorized senders.

Adding Every Email Provider

Only authorize services that actually send email for your domain.

Forgetting Website Email

If your website sends email directly from a server, determine whether that server needs to be authorized.

Ignoring DNS Lookup Limits

Large SPF policies can exceed the 10-lookup limit.

Using the Wrong DNS Provider

Add the record to the authoritative DNS zone.

Changing SPF Without Testing

Always send test emails and inspect authentication results after making changes.

SPF Record Examples

Here are some simplified examples for educational purposes.

Basic SPF Record

v=spf1 -all

This authorizes no sending hosts.

SPF With an IPv4 Address

v=spf1 ip4:203.0.113.10 -all

This authorizes the specified IPv4 address.

SPF With a Provider

v=spf1 include:example-provider.com -all

This delegates part of the authorization policy to the specified domain.

SPF With Multiple Providers

v=spf1 include:provider-one.example include:provider-two.example ~all

Use this only when both providers genuinely send email for the domain and the combined policy remains within SPF processing limits.

SPF Testing Checklist

Use this checklist after learning How to Add an SPF Record:

• Identify the authoritative DNS provider
• List all legitimate email-sending services
• Check whether an SPF record already exists
• Do not create a second SPF record
• Obtain official SPF values from providers
• Add the record as a TXT record
• Use the correct domain/host
• Save the DNS change
• Wait for DNS propagation
• Check the public TXT record
• Send a test email
• Inspect email headers
• Confirm SPF passes
• Check for SPF syntax errors
• Check DNS lookup count
• Remove unused email services
• Review SPF periodically
• Configure DKIM
• Configure DMARC

Frequently Asked Questions

What is an SPF record?

An SPF record is a DNS TXT record that identifies email-sending hosts or services authorized by a domain’s SPF policy.

How to Add an SPF Record to a domain?

Log in to the DNS provider that manages your domain, create or edit the domain’s TXT record beginning with v=spf1, and add the authorized sending mechanisms supplied by your email providers.

Is SPF a TXT record?

Yes. Modern SPF records are published using DNS TXT records. The official SPF specification requires SPF records to be published as TXT records.

Can I have multiple SPF records?

You should not publish multiple SPF records for the same domain. Multiple SPF records can cause SPF evaluation to return a permanent error.

What does v=spf1 mean?

v=spf1 identifies the record as an SPF version 1 policy.

What does ~all mean?

~all produces a softfail for senders that do not match the preceding SPF mechanisms.

What does -all mean?

-all indicates an SPF fail for senders that do not match the authorized mechanisms.

What does include mean in SPF?

include allows one domain’s SPF policy to be evaluated as part of another domain’s SPF policy.

How many DNS lookups can SPF use?

SPF limits DNS-causing mechanisms and modifiers to a total of 10 lookups during evaluation. Exceeding this limit can produce a permerror.

Does SPF stop spam completely?

No. SPF is an email authentication mechanism, not a complete anti-spam solution. It works alongside technologies such as DKIM and DMARC and other reputation and filtering systems.

Does SPF improve email deliverability?

Correct SPF configuration can help receiving systems authenticate legitimate email. However, deliverability depends on many factors, including sender reputation, content, recipient engagement, DKIM, DMARC, and provider-specific policies.

Do I need DKIM and DMARC if I have SPF?

SPF alone is not a complete email authentication strategy. Using SPF, DKIM, and DMARC together provides a stronger framework for authenticating domain email.

Useful External Resources

For the technical SPF standard, see the IETF RFC 7208 SPF specification.

For Gmail and Google Workspace email authentication guidance, see Google’s official email sender guidelines.

For additional Google SPF guidance, see Google Workspace SPF documentation.

For DKIM and DMARC configuration, refer to your email provider’s official documentation and use the SPF information they provide.

Conclusion

Learning How to Add an SPF Record is an important step for anyone managing a domain that sends email.

The process is straightforward: identify your DNS provider, find your existing SPF record, identify every legitimate email-sending service, obtain the correct SPF mechanisms, publish a single TXT-based SPF policy, and test the result.

The most important rule is to avoid creating multiple SPF records for the same domain. If you use several email services, combine their legitimate authorization mechanisms into one SPF policy while keeping the SPF DNS lookup limit in mind.

You should also remember that How to Add an SPF Record is only one part of email authentication. For a stronger configuration, use SPF together with DKIM and DMARC.

After making DNS changes, verify the public record and send test emails to confirm that authentication works correctly.

Once you understand How to Add an SPF Record, you can confidently configure email authentication for business domains, PHP websites, WordPress websites, marketing platforms, and other applications that send email from a custom domain.