SPF record syntax and examples

SPF is a single DNS TXT record that lists the servers allowed to send mail using your domain. The syntax is short, but small mistakes break it completely. This guide explains each part of the record, gives working examples for common setups, and lists the mistakes we see most often. New to SPF? Start with what SPF is and how it works.

What does an SPF record look like?

Here is a typical record:

example.com.  3600  IN  TXT  "v=spf1 ip4:203.0.113.10 include:spf.protection.outlook.com -all"

Read it left to right:

• v=spf1 marks this TXT record as SPF. It must come first.
• ip4:203.0.113.10 allows one server by IP address.
• include:spf.protection.outlook.com allows every server in Microsoft 365's SPF record.
• -all says everything else fails.

Receivers check the IP address of the server that connected to them against this list, in order, and stop at the first match (RFC 7208). SPF checks the envelope sender (the MAIL FROM address, often shown as Return-Path), not the From address people see. Linking the two is DMARC's job.

What does each SPF mechanism do?

Mechanisms are the terms that match a sending IP. They're defined in section 5 of RFC 7208.

Every mechanism marked "Yes" counts toward the limit of 10 DNS lookups per check, including lookups inside the records you include. Go over and the result is PermError. Our guide to SPF PermError: too many DNS lookups covers this in detail.

Anything after all is ignored, so all must be the last mechanism.

What do the SPF qualifiers + - ~ ? mean?

Each mechanism can have a qualifier in front. It sets the result when that mechanism matches.

Because + is the default, include:x means +include:x. Never write +all; it authorizes every server on the internet.

If no mechanism matches and there's no all or redirect, the result is neutral, as if the record ended in ?all. RFC 7208 recommends always ending with an explicit all or a redirect.

What do the redirect and exp modifiers do?

Modifiers use = rather than :.

• redirect=domain hands the whole check to another domain's SPF record when nothing else matches. It's useful when many domains share one policy, for example v=spf1 redirect=_spf.example.com. It's ignored if the record contains all, and if the target has no SPF record the result is PermError (RFC 7208, section 6.1).
• exp=domain points to a TXT record with an explanation string for failed messages. Few receivers show it; most domains don't need it.

redirect and exp may each appear only once; a duplicate is a PermError (RFC 7208, section 6).

Which SPF record fits your setup?

Looking for one provider's exact value? See SPF records by email provider for the include each service documents and what it costs in lookups.

Microsoft 365 only

v=spf1 include:spf.protection.outlook.com -all

This is the record Microsoft gives for domains where Microsoft 365 is the only sender. Our Microsoft 365 SPF record page shows the include's measured lookup cost, and the Microsoft 365 platform page covers filtering.

Google Workspace only

v=spf1 include:_spf.google.com ~all

This is the record from Google's SPF setup guide, which recommends ~all. Changing it to -all is valid once you're sure Google is your only sender. Our Google Workspace SPF record page has the details, and the Google Workspace platform page covers filtering.

Several senders on the main domain

v=spf1 ip4:203.0.113.10 include:spf.protection.outlook.com include:mailer.example.net -all

Microsoft 365 for staff, an on-premises server or website at one IP, and one third-party service. Each new service adds an include to the same record. Never create a second record.

Bulk mail on a subdomain

example.com.       TXT  "v=spf1 include:spf.protection.outlook.com -all"
news.example.com.  TXT  "v=spf1 include:mailer.example.net -all"

Microsoft recommends putting services you don't directly control, such as newsletter tools, on a subdomain. The subdomain needs its own record, and it gets its own 10-lookup budget.

Parked or non-sending domain

v=spf1 -all

Microsoft gives this exact record for parked domains: no server is authorized. Pair it with a DMARC record such as v=DMARC1; p=reject; so the visible From address is protected too (RFC 9989). Do the same for any defined subdomain that never sends mail.

Domain with an inbound filtering service

v=spf1 include:spf.protection.outlook.com -all

If a filtering service only receives your mail, nothing changes in SPF. Microsoft's own guidance for an MX that points to third-party filtering uses the standard Microsoft 365 record and says to add the filter only if outbound mail goes through it.

What are the most common SPF mistakes?

Microsoft's troubleshooting guide lists the colon, space and trailing-dot errors as common syntax mistakes.

This isn't rare. In our October 2026 scan of the Tranco top 1,000 domains, 4 domains published more than one SPF record and 22 went over the 10-lookup limit.

~all vs -all: which should you use?

Both stop SPF from vouching for unknown servers. The difference is how strongly.

• -all (fail) says unlisted servers aren't authorized. Microsoft recommends it for Microsoft 365 domains with DKIM and DMARC, because DMARC then decides what happens to failures, and DMARC reports let you check the results.
• ~all (softfail) says they probably aren't. Google's guide recommends it.

Under DMARC, both count as an SPF fail. In practice, the deciding factor is your DMARC policy, not the qualifier. Of the 764 top-1,000 domains in our scan that publish SPF, 438 end in -all, 274 in ~all, 19 in ?all, and 33 use redirect.

Long records and multiple strings

A single TXT string is limited to 255 characters. Longer records can be split into several quoted strings in one TXT record, which receivers join with no added space:

"v=spf1 include:spf.protection.outlook.com include:mailer.example.net "
"include:crm.example.org -all"

Note the space at the end of the first string. RFC 7208 also recommends keeping the whole record small enough to fit in a 512-byte DNS response.

How do you write or change your SPF record?

1. List every service that sends as your domain: your mailbox platform, website forms, CRM, helpdesk, invoicing and newsletter tools. Google's sender guidelines say missing senders are more likely to be marked as spam.
2. Get each vendor's documented include or IP range. Don't guess.
3. Move bulk senders to a subdomain where you can.
4. Build one record, starting with v=spf1 and ending with ~all or -all.
5. Check it with the SPF Checker for syntax and lookup count.
6. Replace the old record at your DNS host. Edit it; don't add a second one.
7. Test by sending from each service to an outside mailbox and checking spf=pass in the headers.
8. Add DKIM and DMARC. Google requires SPF or DKIM from all senders, and SPF, DKIM and DMARC from bulk senders.

Next steps

• Run your domain through the SPF Checker to see your current record, lookup count and any syntax problems.
• Building a record from scratch? The SPF Record Generator assembles one from your mail services and estimates its lookups. For the exact include each service documents, see SPF records by email provider.
• Publish v=spf1 -all plus a reject DMARC policy on every domain you own that doesn't send mail.
• Check your DMARC record with the DMARC Checker; our DMARC record examples show what to publish.
• If you want to know when someone changes your SPF record, iBlockSpam domain monitoring sends drift alerts.

Browse our other SPF, DKIM and DMARC guides.