To create an SPF record, publish one DNS TXT record at the authoritative DNS provider for your sending domain. Start the value with v=spf1, add every legitimate mail service using its documented include: or IP mechanism, and finish with a qualifier such as ~all or -all. If more than one SPF record exists, merge the mechanisms into a single record rather than adding another.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The most common failures are duplicate SPF records, an incorrect DNS host or owner name, an envelope-from domain that differs from the domain you edited, and exceeding SPF’s 10-DNS-lookup limit. The procedures below cover creation, provider examples, diagnosis, propagation, and the relationship between SPF, DKIM, and DMARC.
As an Amazon Associate I earn from qualifying purchases.
What an SPF record does
Sender Policy Framework (SPF) lets a receiving mail server check whether the system that delivered a message is authorized to send mail for a domain. Google Workspace defines an SPF record as a list of mail servers and domains allowed to send email on behalf of your domain.
SPF is not a setting inside your mailbox application. It is a DNS TXT record published at the DNS service that is authoritative for the domain. During delivery, the recipient evaluates mechanisms in the record against the sending IP address. Common mechanisms include:
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
| Mechanism | Purpose | Example |
|---|---|---|
ip4 |
Authorizes an IPv4 address or CIDR range. | ip4:192.0.2.0/24 |
ip6 |
Authorizes an IPv6 address or range. | ip6:2001:db8::/32 |
include |
Authorizes the senders listed by another domain, normally a mail provider’s published SPF policy. | include:_spf.google.com |
a |
Uses the IP addresses returned for a domain’s A or AAAA records. | a:mail.example.com |
mx |
Uses the IP addresses of the domain’s MX hosts. | mx |
An SPF value begins with v=spf1. Its final qualifier tells the receiver how to treat a source that does not match. ~all is a soft fail, while -all is a fail. The correct choice depends on whether every legitimate sender has been identified and added.
The qualifier does not add authorization. A message from a service that is missing from the mechanisms fails SPF whether the record ends in ~all or -all. Conversely, changing from a soft fail to a hard fail cannot correct a missing provider entry. Treat the ending as an enforcement decision made after the sender inventory is complete.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsPrepare before changing DNS
SPF errors often happen because an organization edits the wrong DNS zone or forgets a service that sends mail. Make an inventory first.
- List the primary mailbox service.
- List marketing, newsletter, ticketing, CRM, website, application, and transactional-mail systems that send with your domain.
- For each service, identify the envelope-from or return-path domain. That is the domain whose SPF record the receiving server evaluates; it may not be the visible From address.
- Find the DNS provider that is authoritative for the domain. If your registrar delegates DNS to a hosting company or another provider, edit the active zone there.
- Inspect the existing TXT records at the exact domain or subdomain before adding anything.
SPF applies separately to each domain and subdomain. A record at example.com does not automatically authorize mail sent with bounce.example.com as its envelope-from domain. If a vendor uses a dedicated bounce subdomain, document that name and publish or verify the policy at that subdomain instead of assuming the root record covers it.
How to create the record
- Open the authoritative DNS dashboard. In a typical interface, choose DNS, then Add record, and select TXT. Cloudflare’s documented workflow uses
@as the name for the root domain; other dashboards may display the root as the bare domain or leave the name field blank. - Collect each provider’s documented mechanism. Use the exact
include:value supplied for your edition and service. Do not substitute a similarly named value from another provider. - Build one SPF value. Start with
v=spf1, place all required mechanisms separated by spaces, and end with the chosen qualifier. For example, a domain using two providers might containv=spf1 include:provider-one.example include:provider-two.example ~all; the provider names here are illustrative, not values to publish. - Save the TXT record. Do not create a second TXT value beginning with
v=spf1at the same owner name. - Confirm the published result. Check the authoritative DNS response and at least one public resolver. Verify the owner name, the complete value, and that no other SPF value exists at that name.
- Send a controlled test. After DNS has propagated, send a message through each legitimate service and inspect the message’s
Authentication-Resultsheader. It should identify the envelope-from domain and show the SPF result for that domain.
Keep a dated copy of the final value and the list of services it covers. That record makes future changes safer: when a marketing platform is retired, remove its mechanism from the one policy; when a new application is launched, add its documented mechanism to the same policy. Do not paste a complete provider policy into a second TXT record or concatenate two v=spf1 prefixes.
Provider examples
The following strings are official examples for narrowly defined configurations. They are starting points, not universal records. Add mechanisms for every other service that legitimately sends mail and remove services that no longer do.
| Configuration | Example SPF value | Ending qualifier | What you still need to check |
|---|---|---|---|
| Google Workspace only | v=spf1 include:_spf.google.com ~all |
~all (soft fail) |
Add any website, marketing, CRM, or transactional sender. |
| Microsoft 365 only | v=spf1 include:spf.protection.outlook.com -all |
-all (fail) |
Add any non-Microsoft service that sends for the domain. |
| Google Workspace and Microsoft 365 | v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all |
~all (soft fail) |
Merge additional senders into this same record. |
Changing the ending qualifier does not authorize a new sender. Authorization comes from the mechanisms before the qualifier. A sender omitted from the record can still fail SPF even when the record is syntactically valid.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Compare provider choices on four practical points: which products the mechanism covers, how many DNS lookups its include chain consumes, which qualifier the vendor recommends, and whether your other senders must be merged. A provider may publish separate values for different products or editions, so always use the instruction that matches the service actually sending your mail. Remove an old provider’s include after migration; leaving it in place needlessly expands the policy and can authorize infrastructure you no longer control.
How to fix multiple SPF records
A domain or subdomain must have exactly one SPF policy. Publishing two TXT records that both begin with v=spf1 causes an SPF error, commonly reported as permerror. Receiving servers cannot reliably decide which policy to use.
Symptoms
- Diagnostic tools report “multiple SPF records,” “duplicate SPF,” or
permerror. - Messages from otherwise authorized services show an SPF failure.
- The DNS dashboard shows two or more TXT values beginning with
v=spf1at the same name.
Repair procedure
- Copy the existing SPF values before editing so you can identify every sender.
- Keep one record and combine all legitimate mechanisms in it. For example, combine two separate policies into one value containing both
include:terms, rather than placing the two completev=spf1 ...strings side by side. - Delete obsolete mechanisms for services that no longer send mail.
- Use one final qualifier at the end of the merged value.
- Save, verify that only one
v=spf1value remains, and retest after propagation.
Do not solve duplicate records by changing the TXT record type, adding a second subdomain, or copying a provider’s example without merging your other senders. Each envelope-from domain needs its own single policy.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How to fix the “too many DNS lookups” error
SPF evaluation has a limit of 10 DNS lookups. Mechanisms such as include, a, mx, and redirect processing can consume that budget, and an include can lead to additional lookups in the included domain. Exceeding the limit produces a permanent SPF error even when every listed provider is legitimate.
Find what consumes the budget
- Count every DNS-querying mechanism in the record and examine nested
include:policies. - Look for repeated providers, old vendors, broad
mxmechanisms, andamechanisms that are not needed. - Check the current policy published by each included provider; its lookup count can change when that provider changes its infrastructure.
Reduce lookups safely
- Remove services that no longer send mail.
- Replace an unnecessary
mxoramechanism with a narrowly maintained IP range when the service documents stable ranges and you can keep them current. - Ask the vendor whether it supports a lower-lookup configuration or a provider-managed SPF flattening design.
- Recalculate the complete chain after every change, including nested includes.
Flattening means publishing the provider’s current IP addresses instead of its include chain. It can lower lookup usage, but it creates maintenance work: provider IP addresses may change, and a stale flattened record can authorize the wrong systems or block current ones. Use it only when the vendor documents how updates are maintained. Never copy an IP list once and assume it remains valid indefinitely.
When SPF is missing or “not working”
The record is at the wrong DNS host
Query the authoritative nameservers to determine which zone is active. If DNS is managed through a hosting partner, changes made in a separate DNS dashboard will not affect the public record. Make the edit where the domain’s nameservers direct you.
The owner name is wrong
For mail using the root domain, many dashboards expect @. A record entered as mail, www, or the fully qualified domain when the dashboard automatically appends the domain can publish at the wrong name. Confirm the exact owner name shown in the DNS response.
Recommended Free Tools
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
The value is malformed
Check that the value starts exactly with v=spf1, mechanisms are separated by spaces, and the final qualifier is present. Remove accidental line breaks, pasted formatting, and extra quotation marks introduced by the dashboard. A TXT record may be displayed in several interface fields, but the resulting DNS value must form one valid SPF policy.
The tested domain is not the SPF domain
Inspect the message header for the envelope-from or return-path domain. If a service sends with bounce.example.com, editing only example.com will not authorize that transaction. Publish the required record at the domain actually used during SMTP delivery.
The record exceeds size limits
Google Workspace documents a 255-character SPF record limit and a 512-byte TXT-file limit. Long lists of mechanisms, nested provider policies, or duplicated entries can exceed those limits. Remove obsolete senders and reduce lookup-heavy mechanisms; do not truncate a provider’s published include value.
Some DNS panels split a long TXT value into quoted segments for display. That is acceptable only if the DNS response reconstructs one continuous SPF value. Verify the result as a resolver sees it rather than relying on how the editing form wraps text.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How long SPF changes take to work
Google says SPF authentication can take up to 48 hours after a record is added. A resolver may continue serving a cached answer according to the previous record’s TTL, while another resolver already sees the change.
- Wait 24 to 48 hours before assuming a valid edit failed.
- Query more than one public DNS resolver and, when possible, query the authoritative nameserver directly.
- Confirm that all resolvers return the same owner name and value.
- Send a new test message; an old message’s authentication header cannot be retroactively changed.
- Avoid repeated edits while caches still contain the old value. Each change can make diagnosis harder and may restart caching intervals.
When legitimate mail still fails SPF
A valid-looking record does not prove that every outbound path is covered. Work through the actual delivery path:
- Identify which application sent the failing message.
- Read the message headers to find the envelope-from or return-path domain and the connecting IP.
- Compare that domain with the DNS name you edited.
- Obtain the service’s current SPF instruction and add its documented mechanism to the single record.
- Check whether the service uses different sending domains for different products, regions, or message types.
- Retest from that service after the DNS change is visible publicly.
Do not authorize an unknown IP merely because it appeared in one message. Confirm ownership with the service’s documentation and remove temporary mechanisms after troubleshooting.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
SPF, DKIM, and DMARC work together
SPF authenticates the sending infrastructure identified by the envelope-from domain. It does not by itself prove that the visible From address was authorized, and spoofing techniques can bypass an SPF-only deployment.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →- SPF: publishes permitted sending infrastructure in DNS.
- DKIM: adds a cryptographic signature to the message; the recipient checks the public key in DNS.
- DMARC: lets the domain owner specify how messages should be handled when authentication or alignment checks fail and provides reporting.
Configure DKIM and DMARC alongside SPF. Keep the SPF record accurate even after DKIM is enabled, because different receivers and message paths may rely on different authentication results.
Operational limits and a verification checklist
| Requirement | Practical rule | Failure if ignored |
|---|---|---|
| Records per domain or subdomain | Publish exactly one TXT record beginning with v=spf1. |
Multiple records can return permerror. |
| DNS lookups during evaluation | Keep the complete mechanism and include chain within SPF’s 10-lookup limit. | “Too many DNS lookups” and a permanent error. |
| SPF record length | Stay within the documented 255-character SPF record and 512-byte TXT-file limits. | Truncation or an invalid policy. |
| Provider mechanisms | Use each provider’s current, documented include: value. |
Unauthorized or incorrectly authorized mail. |
| Propagation | Allow as much as 24–48 hours, then query multiple resolvers. | Testing an old cached answer and making unnecessary edits. |
Final checklist
- Every legitimate outbound service is inventoried.
- The SPF record is published at the authoritative DNS provider.
- The owner name matches the envelope-from domain.
- Only one
v=spf1TXT record exists at that name. - All provider mechanisms are copied exactly from current documentation.
- Obsolete senders and duplicate mechanisms are removed.
- The full policy stays within the 10-lookup, 255-character, and 512-byte limits.
- Authoritative and public DNS queries show the intended value.
- Test messages show the expected SPF result in
Authentication-Results. - DKIM and DMARC are configured as complementary controls.
Practical maintenance after deployment
SPF is not a one-time checkbox. Review the policy whenever you add or retire a sender, change a marketing or ticketing platform, move DNS hosting, or adopt a new envelope-from domain. Keep an owner for the record and document why each mechanism exists. A quarterly review can catch abandoned vendor entries before they consume lookup capacity or authorize infrastructure that is no longer part of your mail flow.
When a provider changes its published include policy, the change can alter both authorized IPs and lookup consumption without any edit in your DNS dashboard. Recheck the complete chain after major provider changes and after any flattening update. If you cannot keep a flattened list synchronized, use the provider’s maintained include instead and remove lower-value mechanisms elsewhere to stay under the limit.
Frequently Asked Questions
How do I create an SPF record for my domain?
Inventory every service that sends mail, find the authoritative DNS provider, add one TXT record at the exact envelope-from domain, start with v=spf1, add each provider’s documented include: or IP mechanism, and finish with ~all or -all. Verify the published value and test after propagation.
What SPF record should I use for Google Workspace?
For Google Workspace alone, Google’s documented example is v=spf1 include:_spf.google.com ~all. Add mechanisms for any website, CRM, marketing, ticketing, or transactional service that also sends mail.
What SPF record should I use for Microsoft 365?
Microsoft documents v=spf1 include:spf.protection.outlook.com -all for Microsoft 365. Merge other legitimate senders into this same record rather than publishing another SPF TXT value.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
How do I combine Google Workspace and Microsoft 365?
Use one merged value such as v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all, then add any additional documented mechanisms and confirm the complete policy remains within the lookup and length limits.
How do I fix multiple SPF records?
Delete or edit the duplicates so only one TXT value beginning with v=spf1 remains at the domain or subdomain. Combine the legitimate mechanisms and use one final qualifier. Multiple SPF records commonly produce permerror.
How do I fix the SPF too many DNS lookups error?
Remove retired services and unnecessary a, mx, or nested include mechanisms. Consider a vendor-supported maintained flattening design or documented stable IP ranges, then recalculate every nested lookup after each change. SPF evaluation must stay below ten DNS lookups.
Why is my SPF record failing even though it looks correct?
Check that you edited the authoritative DNS host, used the correct owner name, published exactly one v=spf1 value, and covered the envelope-from or return-path domain actually used by the sender. Confirm the provider’s current mechanism and allow DNS caches to expire before retesting.
How long does an SPF record take to work?
Google says activation can take up to 48 hours. Query the authoritative server and multiple public resolvers, then send a new test message. Older messages retain the authentication result they received when delivered.
Does SPF replace DKIM and DMARC?
No. SPF authenticates sending infrastructure, while DKIM supplies a cryptographic signature and DMARC adds alignment policy and reporting. Configure all three as complementary controls.
Free tools Windows power users keep installed
One-click scans. No signup required.
The Bottom Line
Publish exactly one SPF TXT record at the authoritative DNS provider for the domain actually used as the envelope-from. Merge every legitimate sender with its current documented mechanism, remove retired services, keep nested evaluation below ten DNS lookups and within the 255-character and 512-byte limits, then verify through authoritative and public DNS queries. Allow up to 24–48 hours for propagation, retest each sending service, and deploy DKIM and DMARC alongside SPF.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
