# SPF record for iCloud Mail (custom domain)

URL: https://iblockspam.com/spf/icloud-mail
Last updated: 2026-10-22

Include: include:icloud.com
Where it goes: Your custom domain (@)
DNS lookups: 5 of 10

For a custom email domain in iCloud Mail (part of iCloud+), Apple gives the SPF record v=spf1 include:icloud.com ~all, published as a TXT record on the domain itself (host @). If the domain already has an SPF record, Apple says to add include:icloud.com to it before ~all rather than create a second one. We measured the include at 5 DNS lookups.

## Example records

- iCloud Mail only (Apple's value) (TXT, host @): `v=spf1 include:icloud.com ~all`
- iCloud Mail and a newsletter service that needs an include (Mailjet) (TXT, host @): `v=spf1 include:icloud.com include:spf.mailjet.com ~all`

## Notes

- On 22 October 2026, `icloud.com` redirected to `_spf.icloud.com`, which nested three more includes, for 5 lookups in total. That is half the budget of 10.
- If your registrar doesn't accept `@` as a host, Apple says to enter your domain name instead. If it rejects quotes or a trailing period, leave them out.
- Apple says you can't set up a domain with iCloud Mail while your registrar has a lock on it.

## How to add it

- Start the custom domain setup in iCloud Mail and enter the addresses you already use at the domain; Apple then shows the records to add.
- Sign in to your domain registrar or DNS host. Apple says the settings may be under names such as Advanced Settings, DNS Management or Mail Settings.
- Find the TXT record on `@` that starts with `v=spf1`. If there is one, add `include:icloud.com` before `~all`. If there isn't, create a TXT record with `v=spf1 include:icloud.com ~all`.
- Add the other records Apple lists in the same session: the verification TXT record, the two MX records and the `sig1._domainkey` DKIM CNAME. Apple asks for a TTL of 3600 seconds.
- Back on the iCloud Mail setup page, click Verify. Apple says it can take a few minutes; then check the live record with the SPF Checker below.

## DKIM and DMARC

Apple's record set includes a DKIM CNAME at `sig1._domainkey` that points to a target built from your own domain name (see our [iCloud Mail DKIM page](https://iblockspam.com/dkim/icloud-mail)). With SPF and DKIM in place, add a [DMARC record](https://iblockspam.com/blog/dmarc-record-examples) so receivers know what to do with mail that fails both.

## Common mistakes

- Creating a second `v=spf1` record for iCloud Mail next to an existing one. Apple says to add the include to the record you have.
- Keeping the old MX records. Apple's setup asks you to delete the existing MX records before adding its two.
- Copying Apple's DKIM example literally: the `sig1` CNAME target contains your own domain name in place of `example.com`.

**Q: What SPF record does Apple give for an iCloud+ custom email domain?**
`v=spf1 include:icloud.com ~all`, as a TXT record on host `@`. If another service already has an SPF record on the domain, add `include:icloud.com` to that record before `~all` instead of publishing a second one.

**Q: How many DNS lookups does include:icloud.com cost?**
We measured 5 on 22 October 2026: the include itself, a redirect to `_spf.icloud.com` and three nested includes. That leaves 5 of the 10 allowed lookups for every other service in the same record. The [SPF Checker](https://iblockspam.com/tools/spf-checker) counts your live total.

**Q: Why did my iCloud Mail domain fail verification?**
Apple says to recheck the records for errors. Common causes: a second SPF record, old MX records left in place, a host that doubled your domain name, or a DKIM target still containing `example.com`. Apple also says a registrar lock on the domain blocks setup.

Sources:
- Apple Support: Set up an existing domain with iCloud Mail: https://support.apple.com/en-us/102374

---

Source: iBlockSpam, https://iblockspam.com/spf/icloud-mail (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt