How to spf record?
- Open Command prompt (Start > Run > cmd)
- Type "nslookup -type=txt" a space, and then the domain/host name.
- If an SPF record exists, the result would be similar to:
An SPF record identifies the mail servers and domains that are allowed to send email on behalf of your domain. Receiving servers check your SPF record to verify that incoming messages that appear to be from your organization are sent from servers allowed by you.
Domains can have one SPF record. However, the SPF record for a domain can specify multiple servers and third parties that are allowed to send mail for the domain.
If all email from your organization is sent using Google Workspace only, copy this line of text for your SPF record:
v=spf1 include:_spf.google.com ~all
Go directly to the next step, Add your SPF record at your domain provider.
If you send mail with other servers or third-party services in addition to Google Workspace, create a custom SPF record that authorizes these senders. If you’re not sure what these services are, review Identify all email senders for your organization, in Before you set up SPF.
Your SPF record should include a reference to Google Workspace, and to the domains and IP addresses of all servers or services that send mail for your domain.
Here are example SPF records for common email setups that use Google Workspace and other senders. Every example includes _spf.google.com, which is required to send mail with Google Workspace.
Start with this SPF record for Google Workspace, then add the information for your other senders:
v=spf1 include:_spf.google.com ~all
Important: The IP addresses and domain names used in this table are examples. Replace them with IP addresses and domains for your senders.
After reading this article you will be able to create your own SPF TXT record, assuming that you are familiar with DNS and DNS TXT records.
The Sender Policy Framework (SPF) is an email authentication technique that is used against email spoofing. Setting up an SPF record helps to prevent malicious persons from using your domain to send unauthorized (malicious) emails, also called email spoofing. The SPF protocol is used as one of the standard methods to fight against spam and is also used in the DMARC specification.
An SPF record is a TXT record that is part of a domain’s DNS (Domain Name Service). An SPF record lists all authorized hostnames / IP addresses that are permitted to send email on behalf of your domain.
Some email recipients strictly require SPF. If you haven’t published an SPF record for your domain, your email can be marked as spam or even worse the email will bounce. If an email is sent through an unauthorized mail server, the email can be marked as spam. Having a properly set up SPF record will improve your email deliverability and will help to protect your domain against malicious emails sent on behalf of your domain. The email validation system DMARC creates a link between SPF and DKIM.
To protect your brand against spoofing and phishing attacks you have to authenticate your email. Create your SPF record by following these steps:
The Sender Policy Framework (SPF) gives the ability to authenticate your email and to specify which IP addresses are allowed to send email on behalf of the specific domain.
In order to successfully implement SPF you first need to identify which mail servers are used to send email for your domain. These mail servers can be any sending organization, you should think of your Email Service Provider, Office mail server and any other third-party mail servers that may be used to send email for you.
Now you’ve got a clear overview of all sending domains, you have to create an SPF record for every domain, even if the domain doesn’t actively send email (more information about: How to secure inactive/parked domains).
There are many available SPF tags, more information can be found at the SPF parts explanation page.
• After defining your SPF record your record might look something like this: v=spf1 ip4:34.243.61.237 ip6:2a05:d018:e3:8c00:bb71:dea8:8b83:851e include:thirdpartydomain.com -all
• For domains that aren’t sending email, we recommend you to publish the following record v=spf1 -all
Please keep in mind that your SPF record cannot be over 255 characters and has a maximum of 10 include tags, also known as “lookups”. Please note that the ‘nested lookups’ will also count. If a record has an A and MX lookup, these will both count as lookups for your domain.
Now you have created your SPF TXT record you can publish it into your DNS.
Finally, after defining your SPF record it’s time to publish the record into your DNS. Doing so, mail receivers like (Gmail, Hotmail and others) can request it. An SPF record needs to be published into your DNS by your DNS manager. This can be an internal role in your organization, you can have access to a dashboard provided by your DNS provider yourself or you can ask your DNS provider to publish the record.
Please make sure that your SPF record doesn’t exceed the maximum of 10 lookups! Please note that the ‘nested lookups’ will also count. If an ‘included’ domain has an A and MX lookup, these will both count as lookups for your domain as well. You can prevalidate your SPF record by using our free SPF record Checker.
Your SPF record needs to be published into your DNS;
Your new SPF record can take up to 48 hours to go into effect. For help adding TXT records, contact your domain host.
Setting up the an SPF record is an essential part of your technical settings. Read more about how to check and validate your SPF record or directly test your SPF record by using our SPF record Checker.
The SPF record is correctly configured when:
There are many available SPF tags, more information can be found at the SPF parts explanation page.
SPF is one of the email authentication techniques on which DMARC is based. The email validation system DMARC creates a link between SPF and DKIM. DMARC uses the result of the SPF checks and adds a check on the alignment of the domains to determine its results. More information about: DMARC
Setting up Sender Policy Framework (SPF) for your domain is both simple and necessary to prevent email delivery issues from occurring. Beyond the basic requirement of having a valid SPF record for ALL of your sending domains (and subdomains) implementing SPF is a vital step in achieving DMARC compliance.
SPF Set Up
Essentially, you set up an SPF record to reflect any IP addresses that will be sending email on your domain’s behalf. If your business has an SPF DNS record, it is publicly accessible. When an email is sent claiming to be from your domain, the recipient server checks your SPF record to see if the sender is authorized to send on your behalf. If yes, the email receiver recognizes the message is from you or a trusted third party and will choose to accept it based on your email reputation. If no, the email recipient can choose to examine the message more, quarantine it, or outright reject it. Hence, SPF is a powerful tool in the continuing fight against problematic email fraud (e.g., spoofing, phishing, spam).
To initiate SPF for your domain via your DNS hosting provider, follow these general guidelines:
v=spf1 a mx ip4:xxx.xxx.xxx.xxx -all
*Note: Instructions to implement SPF might differ for your specific DNS hosting provider.
