What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To add an SPF record, first identify every service that sends email using your domain, then publish one TXT record that authorizes those senders. Check for an existing SPF record before making changes: a second SPF record can cause authentication problems. After publishing, allow time for DNS changes and verify SPF in a test message’s headers.
What an SPF record does—and what it does not
Sender Policy Framework (SPF) is a policy published in DNS that tells receiving mail systems which hosts are authorized to send email for a domain. Under RFC 7208, receivers evaluate SPF against the SMTP MAIL FROM or HELO identity used during delivery. SPF does not directly authenticate every address a recipient sees, such as the visible From address, and it does not by itself prevent all spoofing.
As an Amazon Associate I earn from qualifying purchases.
Google describes SPF as a way to help prevent outgoing email from being marked as spam. It is one part of email authentication; Google also recommends configuring DKIM and DMARC.
Before you change DNS: find every sender
Make a list of all systems that send mail using your domain. A mailbox provider may be only one of several senders. Include business applications and website functions, and ask the people responsible for those systems which services send messages and what SPF configuration each currently requires.
#1 Best Overall
- Your hosted or on-premises mail service
- Website servers, contact forms, and other automated messages
- Outbound gateways or relays
- Marketing, customer-support, sales, and other third-party email services
Missing a legitimate sender can cause its mail to fail SPF checks. Conversely, leaving a retired sender in the policy keeps authorizing a service that no longer needs to send for your domain.
How to add or update the SPF record
- Check the domain’s current TXT records. In the DNS controls provided by your domain host, look for a TXT record whose value starts with
v=spf1. If one exists, update it to include all current senders rather than adding another SPF record. - Collect each sender’s current SPF instructions. Use the provider’s documentation for the specific service and configuration you have. Do not assume that a generic example or another organization’s policy will fit your domain.
- Build one policy for the complete sender list. An SPF value begins with
v=spf1and contains mechanisms or provider-specific includes that authorize the actual senders. Google’s documented example for a domain that sends only through Google Workspace isv=spf1 include:_spf.google.com ~all. That example is not appropriate unchanged if other services also send mail for the domain. Google recommends~allin its setup instructions; follow the current instructions for your actual senders. - Publish the value as a TXT record. Add or update the TXT record in your domain host’s DNS settings. The host/name field and whether the value needs quotation marks depend on the provider’s interface. Enter the policy exactly as instructed by that provider.
- Set up sending subdomains separately. If mail is sent from a subdomain, configure an SPF record for that subdomain too; the parent domain’s policy does not automatically cover it.
- Allow DNS time, then verify. Google says SPF authentication can take up to 48 hours to start working after setup. Send a test message and inspect its full headers for the
Authentication-Resultsentry and SPF result.
What should the SPF value be?
There is no universal SPF value: it depends on which systems send mail for your domain. The Google Workspace-only example above authorizes that service, not an unrelated website, application, or marketing sender. For every service in your inventory, follow its current SPF guidance and combine the required authorizations into the domain’s single policy.
Rank #2
When constructing the policy, account for SPF’s DNS lookup limit. Google’s troubleshooting guidance says SPF supports up to 10 DNS lookups and identifies mechanisms such as a, mx, include, and ptr as mechanisms that can result in lookups. Exceeding the limit can prevent messages from passing SPF. Avoid adding mechanisms or includes without confirming they are needed and understanding their lookup cost.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhy an SPF check may fail
A legitimate message fails SPF
Check whether the system that sent it—especially a website contact form or third-party service—is included in the policy. Confirm the provider’s current SPF instructions and that the DNS record reflects the full sender inventory.
Rank #3
No SPF result appears in the message
Inspect the full message header for Authentication-Results, as Google advises. If the expected result is absent, check that SPF is published correctly as a TXT record and that the receiving system is evaluating the message.
The policy exceeds the lookup limit
Review the policy’s mechanisms and provider includes; the DNS lookups they trigger count toward the limit of 10 described in Google’s troubleshooting guidance. Ask the relevant provider or DNS administrator for help simplifying the policy without removing a sender that still needs authorization.
A subdomain’s mail fails
Publish a separate SPF policy for the sending subdomain. A record on the parent domain does not substitute for the subdomain’s own configuration.
A setup screen still reports pending
DNS changes may not be visible everywhere immediately. Google’s stated estimate for SPF authentication to start working is up to 48 hours; the exact experience can depend on DNS providers and propagation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How SPF fits with DKIM and DMARC
SPF, DKIM, and DMARC address email authentication in complementary ways, so SPF should not be treated as a complete anti-spoofing solution. Google recommends setting up all three. Its Gmail sender guidelines say that all senders to Gmail accounts must use SPF or DKIM, and bulk senders sending more than 5,000 messages per day must use all three. These are Google’s published requirements for mail sent to Gmail accounts; check its current guidance when configuring a sending domain because provider rules can change.
Keep the record current
Revisit the SPF policy whenever you add or remove a mail server, website function, gateway, or third-party sender. Update the existing policy so it matches the services still authorized to send for the domain, then verify a test message’s authentication results.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
