SPF record for SMTP2GO

The exact SPF record

Copy the example that matches your setup. Each one is a single TXT record; the host is shown as your DNS provider usually expects it (@ means the domain itself).

Return-path CNAME (not TXT); your host name comes from SMTP2GO

Type: CNAME · Host: em12345 Copy

return.smtp2go.net

If you need the return path's SPF to end in -all

Type: CNAME · Host: em12345 Copy

return-alt.smtp2go.net

Your main domain on Microsoft 365 stays as it is

Type: TXT · Host: @ · 1 of 10 DNS lookups Copy

v=spf1 include:spf.protection.outlook.com -all

How SPF applies to SMTP2GO mail

SMTP2GO sends with a bounce (MAIL FROM) address on a subdomain set up for it, and receivers check SPF on that subdomain. Your main domain's SPF record doesn't need to change for SMTP2GO.

• SMTP2GO recommends a TTL of 14400 seconds (4 hours) for these records.
• Since 11 April 2025, SMTP2GO requires every email to come from a verified sender: a verified domain or a single verified address.
• If company policy rules out CNAME records, SMTP2GO says it can enable TXT and MX records instead on request.

How to add it

1. In the SMTP2GO dashboard, go to Sending, Verified Senders, Sender domains, click Add sender domain and enter the domain you send from.
2. Add the three CNAME records shown: the return path (SPF), DKIM and the link-tracking domain. SMTP2GO can add them for you through Entri, or you add them by hand.
3. If your DNS host is Cloudflare, set each record to DNS only and turn off CNAME flattening, as SMTP2GO's Cloudflare guide says.
4. Click Verify. The domain is set up once its status shows Verified. Leave your main domain's SPF record unchanged.

DKIM and DMARC alignment

DKIM is covered by the second CNAME, which points to dkim.smtp2go.net; see our SMTP2GO DKIM page. Without a verified domain, SMTP2GO signs with its own domain and Gmail can show "via smtpcorp.com". DMARC is a separate TXT record you add yourself.

DMARC passes when SPF or DKIM passes and the domain it checked matches your From domain. Our guide to SPF, DKIM and DMARC explains how the three fit together.

Common mistakes

• Two SPF records. A domain may publish only one record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail (RFC 7208 section 3.2). Merge every sender into one record.
• More than 10 DNS lookups. Each include, a, mx, exists and redirect costs a lookup, nested ones included; over 10 is a PermError (section 4.6.4). See how to fix too many SPF lookups.
• Choosing ~all or -all without a plan. -all asks receivers to reject unlisted servers; ~all asks them to accept but mark the mail. Once DMARC is enforced, receivers act on DMARC instead. Read SPF soft fail vs hard fail before you choose.
• Adding an SMTP2GO include to your root SPF record because an old guide said so. SMTP2GO says you don't need to update your SPF record.
• Proxying the CNAMEs through Cloudflare or leaving CNAME flattening on, which stops them from verifying.
• Verifying only a single sender address when you could verify the domain. Single sender emails don't use your domain for DKIM or SPF.