SPF record for iCloud Mail (custom domain)

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

iCloud Mail only (Apple's value)

Type: TXT · Host: @ · 5 of 10 DNS lookups Copy

v=spf1 include:icloud.com ~all

iCloud Mail and a newsletter service that needs an include (Mailjet)

Type: TXT · Host: @ · 6 of 10 DNS lookups Copy

v=spf1 include:icloud.com include:spf.mailjet.com ~all

How SPF applies to iCloud Mail mail

Receivers check SPF against the domain in the envelope sender (the MAIL FROM or bounce address). iCloud Mail sends with your own domain there, so its include belongs in the SPF record on the domain you send from.

• On 22 October 2026, icloud.com redirected to _spf.icloud.com, which nested three more includes, for 5 lookups in total. That is half the budget of 10.
• If your registrar doesn't accept @ as a host, Apple says to enter your domain name instead. If it rejects quotes or a trailing period, leave them out.
• Apple says you can't set up a domain with iCloud Mail while your registrar has a lock on it.

How to add it

1. Start the custom domain setup in iCloud Mail and enter the addresses you already use at the domain; Apple then shows the records to add.
2. Sign in to your domain registrar or DNS host. Apple says the settings may be under names such as Advanced Settings, DNS Management or Mail Settings.
3. Find the TXT record on @ that starts with v=spf1. If there is one, add include:icloud.com before ~all. If there isn't, create a TXT record with v=spf1 include:icloud.com ~all.
4. Add the other records Apple lists in the same session: the verification TXT record, the two MX records and the sig1._domainkey DKIM CNAME. Apple asks for a TTL of 3600 seconds.
5. Back on the iCloud Mail setup page, click Verify. Apple says it can take a few minutes; then check the live record with the SPF Checker below.

DKIM and DMARC alignment

Apple's record set includes a DKIM CNAME at sig1._domainkey that points to a target built from your own domain name (see our iCloud Mail DKIM page). With SPF and DKIM in place, add a DMARC record so receivers know what to do with mail that fails both.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). iCloud Mail's include costs 5 on its own. See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. iCloud Mail's documentation uses ~all. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Creating a second v=spf1 record for iCloud Mail next to an existing one. Apple says to add the include to the record you have.
• Keeping the old MX records. Apple's setup asks you to delete the existing MX records before adding its two.
• Copying Apple's DKIM example literally: the sig1 CNAME target contains your own domain name in place of example.com.