SPF records for 18 email providers
The exact SPF include each service documents, where the record goes, and how many of your 10 DNS lookups it uses. Every value links to a page with copy-ready records and the provider's own documentation.
Provider SPF includes at a glance
"Lookups" is what the include costs, nested includes counted, measured with our SPF Checker on October 9, 2026. Services marked "None needed" authenticate your domain with DKIM and don't need an SPF entry.
Mailbox providers
| Provider | SPF include | Where it goes | Lookups |
|---|---|---|---|
| Microsoft 365 | include:spf.protection.outlook.com |
Your domain (@) | 1 |
| Google Workspace | include:_spf.google.com |
Your domain (@) | 1 |
| Zoho Mail | include:zoho.com |
Your domain (@) | 5 |
| GoDaddy | include:secureserver.net |
Your domain (@) | 3 |
| Fastmail | include:spf.messagingengine.com |
Your domain (@) | 1 |
| Proton Mail | include:_spf.protonmail.ch |
Your domain (@) | 2 |
Transactional sending services
| Provider | SPF include | Where it goes | Lookups |
|---|---|---|---|
| Amazon SES | include:amazonses.com |
Custom MAIL FROM subdomain | 1 |
| SendGrid | include:sendgrid.net |
SendGrid's return-path subdomain (em1234) | 2 |
| Mailgun | include:mailgun.org |
The sending domain you verify (a subdomain is recommended) | 5 |
| Postmark | None needed | Not needed (optional pm-bounces CNAME) | 0 |
Marketing platforms
CRM and help desks
| Provider | SPF include | Where it goes | Lookups |
|---|---|---|---|
| Salesforce | include:_spf.salesforce.com |
Your domain (@) | 2 |
| Zendesk | include:mail.zendesk.com |
Your support address's domain (@) | 1 |
| Freshdesk | include:email.freshdesk.com |
Your support address's domain (@) | 7 |
| Intercom | None needed | Not needed (return-path CNAME) | 0 |
DNS lookups per provider include
Every include we measured, most expensive first, including regional and data-center variants. Each count is the include itself plus every lookup nested inside it, measured with our SPF Checker on . Providers can change their records at any time, so check your live total with the SPF Checker.
| Include | Provider | DNS lookups |
|---|---|---|
include:email.freshdesk.com |
Freshdesk | 7 of 10 |
include:mailgun.org |
Mailgun | 5 of 10 |
include:zoho.com |
Zoho Mail | 5 of 10 |
include:one.zoho.com |
Zoho Mail | 4 of 10 |
include:secureserver.net |
GoDaddy | 3 of 10 |
include:_spf.protonmail.ch |
Proton Mail | 2 of 10 |
include:_spf.salesforce.com |
Salesforce | 2 of 10 |
include:sendgrid.net |
SendGrid | 2 of 10 |
include:spf.protection.partner.outlook.cn |
Microsoft 365 | 2 of 10 |
include:_spf.google.com |
Google Workspace | 1 of 10 |
include:amazonses.com |
Amazon SES | 1 of 10 |
include:fdspfaus.freshemail.io |
Freshdesk | 1 of 10 |
include:fdspfeuc.freshemail.io |
Freshdesk | 1 of 10 |
include:fdspfind.freshemail.io |
Freshdesk | 1 of 10 |
include:fdspfus.freshemail.io |
Freshdesk | 1 of 10 |
include:mail.zendesk.com |
Zendesk | 1 of 10 |
include:spf.brevo.com |
Brevo | 1 of 10 |
include:spf.messagingengine.com |
Fastmail | 1 of 10 |
include:spf.protection.office365.us |
Microsoft 365 | 1 of 10 |
include:spf.protection.outlook.com |
Microsoft 365 | 1 of 10 |
How to combine several providers
Your domain gets one SPF record, so every service that sends with your domain in the envelope sender goes into the same line:
- Start with
v=spf1. - Add each provider's include from the table, plus
ip4:orip6:for servers you run yourself. Skip services marked "None needed" and services whose SPF goes on their own subdomain. - Add up the lookups. Stay at 10 or below (RFC 7208 section 4.6.4); if you can't, move a bulk sender to a subdomain with its own record.
- End with one
~allor-all. Our guide to soft fail vs hard fail helps you choose.
For example, Microsoft 365 plus Zendesk is v=spf1 include:spf.protection.outlook.com include:mail.zendesk.com ~all: 2 lookups. Build yours with the SPF Record Generator, and see SPF record syntax examples for every mechanism.
Check your SPF record
See your live record, every nested include and the real lookup count. Free, reads public DNS only.
Frequently asked questions
Can I have more than one SPF record?
No. RFC 7208 allows one SPF record per domain or subdomain. With two or more, receivers return a permanent error and SPF fails for all your mail. Put every provider's include into a single v=spf1 record.
How many includes can one SPF record have?
The limit is on DNS lookups, not includes: at most 10 for the whole evaluation, nested ones included. One include can cost several lookups (Freshdesk's costs 7), so add up the costs in the table or use the SPF Checker.
Why don't Mailchimp, Postmark, Klaviyo and Intercom need an include?
They send with a bounce (MAIL FROM) address on their own domain or a subdomain they manage, and SPF is checked on that domain, not on your From address. They authenticate your domain with DKIM instead, which DMARC accepts.
Related guides
SPF record syntax and examples
SPF record syntax explained: mechanisms, qualifiers and modifiers, with copy-ready examples for Microsoft 365, Google Workspace, subdomains and parked domains.
9 min read SPF, DKIM & DMARCHow to fix SPF PermError: too many DNS lookups
Why SPF breaks at 10 DNS lookups, how to count them, and step-by-step fixes for Microsoft 365 and Google Workspace domains with many senders.
8 min read SPF, DKIM & DMARCSPF softfail vs hardfail: should you use ~all or -all?
What ~all, -all and ?all mean in SPF, what receivers really do with each, how DMARC changes the choice, and which one to use for sending and parked domains.
8 min readValues checked against each provider's documentation on . Sources are listed on each provider's page.