SPF record for Elastic Email

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Elastic Email's example value

Type: TXT · Host: @ · 4 of 10 DNS lookups Copy

v=spf1 a mx include:_spf.elasticemail.com ~all

Keep a and mx only if your own web or mail server sends mail; each costs one lookup.

Google Workspace and Elastic Email

Type: TXT · Host: @ · 3 of 10 DNS lookups Copy

v=spf1 include:_spf.google.com include:_spf.elasticemail.com ~all

Microsoft 365 and Elastic Email

Type: TXT · Host: @ · 3 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com include:_spf.elasticemail.com -all

How SPF applies to Elastic Email mail

Receivers check SPF against the domain in the envelope sender (the MAIL FROM or bounce address). Elastic Email sends with your own domain there, so its include belongs in the SPF record on the domain you send from.

• Elastic Email says most users never add or change MX records for it; an MX warning only means your domain has no mail server set up.
• If no default sender is set and you send from a domain that isn't verified, Elastic Email uses elasticemail.com instead of your domain.
• On 3 November 2026, _spf.elasticemail.com published a single exists mechanism rather than a list of IP ranges.

How to add it

1. In Elastic Email, go to Settings > Domains > Manage Domains, click Start Verification and choose your domain.
2. At your DNS host, open the TXT record on @ that starts with v=spf1 and add include:_spf.elasticemail.com. If there is none, create one.
3. Add the DKIM TXT record on api._domainkey and the tracking CNAME (tracking pointing to api.elasticemail.com) from the same screen.
4. Elastic Email says DNS changes can take up to 48 hours. Then check the status in Manage Domains and the live record with the SPF Checker below.

DKIM and DMARC alignment

Elastic Email's DKIM record is a TXT key on api._domainkey, copied from your account. With SPF and DKIM verified, mail is sent as your domain, and DKIM gives DMARC an aligned pass. Elastic Email strongly suggests a DMARC policy of quarantine or reject once that works. See our Elastic Email DKIM page.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). Elastic Email's include costs 2 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. Elastic Email's documentation uses ~all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Publishing a second SPF record for Elastic Email. Elastic Email says there can be only one per domain, so add the include to the existing one.
• Pasting Elastic Email's example value over your current record and dropping the includes your mailbox provider needs.
• Leaving the tracking CNAME proxied on Cloudflare. Elastic Email says to switch it to DNS only.