SPF (Sender Policy Framework) is a DNS record that lists the mail servers and services allowed to send email for your domain, so receiving providers can spot messages sent from anywhere else.
SPF is a DNS record that lists the servers and services allowed to send email for your domain, such as Google Workspace, Microsoft 365 or your newsletter tool. When a message arrives claiming to be from you, the receiving provider checks the list. Mail from servers that aren't on it is treated as suspicious.
Think of SPF as a guest list for your email. It's one line of text in your domain's DNS that names everyone allowed to send mail as your business. It takes a few minutes to set up and rarely needs changing.
How does SPF work?
An SPF record is a TXT record on your main domain (the @ name) that starts with v=spf1. A business that only sends through Google Workspace would use v=spf1 include:_spf.google.com ~all.
Each include: adds an approved service. The ending tells providers what to do with everyone else: ~all means "probably not us, treat with suspicion" and -all means "definitely not us."
Two rules trip people up:
- A domain gets one SPF record. Two SPF records on the same domain break SPF entirely.
- Each
include:triggers DNS lookups, and the standard caps the total at 10. Go over and providers treat the record as an error.
Why does SPF matter for small businesses?
Without SPF, providers have no way to tell your real invoices from a scammer's copy. It also affects whether your own email lands in the inbox. Google says SPF helps prevent your outgoing email from being marked as spam.
SPF is also one of the two building blocks of DMARC, so you need it in place before you can turn on impersonation protection.
How do I check or set up SPF?
Run our free SPF checker. It shows your current record, flags duplicates, and counts how many of the 10 DNS lookups you're using.
To set one up, list every service that sends email as you: your email provider, website contact forms, newsletter tools, invoicing software. Add each one's include: value to a single record at your DNS host. Your providers publish the exact value to use. For example, Microsoft 365 uses include:spf.protection.outlook.com.
DNS changes can take up to 48 hours to work everywhere, so re-check the next day.
SPF vs DKIM
SPF approves the server that sent a message. DKIM signs the message itself, so it can be verified even after forwarding. They cover different gaps, which is why Google and Microsoft both recommend using SPF, DKIM and DMARC together.
For a look at your whole email setup, a free CyberVigil scan checks SPF, DKIM and DMARC in one go.
Common questions
Can my domain have two SPF records?
No. A domain must have exactly one SPF record. Two records cause SPF to fail with an error, so if you add a new email service, add its include: value to your existing record instead of creating a second one.
Should my SPF record end in ~all or -all?
Both are reasonable. Google recommends ~all (soft fail), while Microsoft recommends -all (hard fail) when DKIM and DMARC are also set up. Never use +all, which approves every server on the internet.
Is SPF enough to stop email spoofing?
Not on its own. SPF checks the hidden sender address used between mail servers, not the From address people see. DMARC closes that gap by requiring the two to match.
Sources
- RFC 7208: Sender Policy Framework (SPF) (IETF / RFC Editor)
- Set up SPF (Google Workspace Help)
- Set up SPF to identify valid email sources for your Microsoft 365 domain (Microsoft Learn)
Related guides and tools
Keep building a safer business
Security is an ongoing process, but it doesn't have to be complicated. Run a free scan, fix what matters most, and check back for more guides.