Skip to content
Book a call
Email deliverability

SPF RecordSender Policy Framework

Federico DonatoneBy · Updated October 15, 2026
Definition

An SPF record (Sender Policy Framework) is a TXT record in a domain's DNS that lists the mail servers allowed to send email for that domain. Receiving servers check it to spot forged senders. A missing or broken SPF record makes your email more likely to be rejected or filtered to spam.

How an SPF record works

DNS is the public address book of the internet, and a TXT record is a line of text stored in it. When an email arrives, the receiving server looks at the domain in the envelope sender (the technical return address, which can differ from the From line a person sees). It fetches that domain's SPF record and checks whether the sending server is on the list. The answer is pass, fail, softfail or neutral.

TXTgrowthcab.comv=spf1 include:_spf.google.com ~allv=spf1 marks the record as SPF, include:_spf.google.com authorizes Google Workspace servers, and ~all asks receivers to treat any other sender as suspicious.

That is the live record on growthcab.com, checked October 15, 2026. It uses 1 DNS lookup, because the single include points to Google's list of sending addresses.

EndingMeaningWhen to use it
-allFail: reject servers not listedEvery sender is listed and tested
~allSoftfail: accept but mark suspiciousThe common safe default
?allNeutral: no opinionRarely useful
+allPass anyoneNever, it lets anyone send as you

SPF record syntax and the 10-lookup limit

Every SPF record starts with v=spf1, lists who may send, and ends with an all rule for everyone else. Senders are added with mechanisms: include points to another domain's list (usually a mail or software provider), ip4 and ip6 name specific addresses, and a and mx authorize the domain's own web or mail servers.

SPF allows at most 10 DNS lookups per check (RFC 7208). Each include, a, mx and redirect counts, and so do the includes nested inside them. Teams that add a CRM, a support desk, a newsletter tool and a cold email platform one at a time often pass the limit without noticing. Past it, the check returns a permanent error, and DMARC treats that as a failure.

From our workPublish one SPF record per domain. Two separate SPF records also make the check return an error (RFC 7208), so add each new service to the existing record instead.

How to set up an SPF record

  1. List every service that sends email as your domain: mailbox provider, CRM, marketing tool, support desk and cold email platform.
  2. Find the include value each one publishes in its setup documentation.
  3. Combine them into a single TXT record at the root of the domain, starting with v=spf1 and ending with ~all or -all.
  4. Count the DNS lookups, nested ones included, and stay within the limit of 10 (RFC 7208).
  5. Send a test email and confirm spf=pass in the message headers.
  6. Add DKIM and DMARC, because SPF alone does not protect the From address the reader sees.
TXTexample.comv=spf1 include:_spf.google.com include:spf.example.net -allAuthorizes Google Workspace plus one other sending service, and asks receivers to fail every server that is not on the list.

Our free cold email domain checker tests SPF and its lookup count together with DKIM and DMARC. If the records look right and email still lands in spam, an email deliverability consultant can trace the cause from message headers. The cold email deliverability checklist shows where SPF fits among the other checks.

Full guideEmail Deliverability Consultant for B2B Outbound

SPF Record FAQ

Do I need an SPF record?
Yes, if your domain sends any email. Without one, receivers cannot tell your real servers from forgers, and Google's email sender guidelines require SPF, DKIM and DMARC from anyone sending 5,000 or more messages a day to Gmail. Publishing an SPF record takes a few minutes in your DNS settings.
What is the difference between ~all and -all in SPF?
~all is a softfail: receivers accept mail from unlisted servers but treat it as suspicious. -all is a hard fail that asks receivers to reject it. Switch to -all only when you are sure every legitimate sender is listed, and remember that once DMARC is in place, its policy carries most of the weight for failing mail.
Can a domain have two SPF records?
No. A domain must publish a single SPF record, and two records make the check return an error (RFC 7208). When you add a new sending service, add its include to the existing record instead of creating a second one.

Related terms

DKIMDKIM (DomainKeys Identified Mail) is an email authentication method that adds a digital signature to every outgoing message. The receiving server uses a public key published in the sender's DNS to check that signature. A valid signature proves the email came from that domain and was not altered on the way. DMARCDMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers what to do with email that uses your domain but fails authentication: deliver it, send it to spam or block it. It builds on SPF and DKIM and sends you reports on who is sending email as your domain. MX RecordAn MX record (mail exchange record) is a DNS record that tells other mail servers where to deliver email for a domain. It points to one or more mail server host names, each with a priority number. Without a working MX record, a domain cannot receive email, and receivers may treat its outgoing mail as suspicious. Email DeliverabilityEmail deliverability is the share of your sent emails that reach the recipient's inbox instead of bouncing or landing in spam. It depends on four things: authenticated sending domains, a verified contact list, a steady daily volume per mailbox, and messages relevant enough that recipients do not report them as spam.

Want these systems running inside your sales team?

Growth Cab is a go-to-market consulting firm for B2B tech companies selling $50,000+ deals. We build the outbound, LinkedIn and closing systems.

Apply to GC GTM Glossary