Glossary
How SPF works, what a correct record looks like, and the mistakes that quietly break it.
In short
An SPF (Sender Policy Framework) record is a DNS TXT record on your domain that lists which mail servers may send email for it. Receiving servers check the sending server against that list; mail from servers not listed can be marked as spam or rejected. A domain may publish only one SPF record.
Your mailbox provider (Google Workspace, Microsoft 365, Zoho, Hostinger), plus any tool that sends from your domain, such as a CRM or helpdesk.
Start with v=spf1, add an include: for each service, and end with ~all (soft fail) or -all (fail). Example: v=spf1 include:_spf.google.com ~all.
Add it at the root of your domain in your DNS host. Replace any older SPF record rather than adding a second one.
Run a free check to confirm the record is found, ends with ~all or -all, and stays within the lookup limit.
SPF looks at the server that delivered the message and the domain in the envelope sender (the Return-Path), not the From address people see. That is why SPF alone does not stop look-alike From addresses, and why DMARC checks that the domains line up.
Two SPF records on one domain, which makes SPF fail. More than 10 DNS lookups across include, a, mx, and redirect mechanisms, which also fails. Ending with +all, which allows anyone to send. Forgetting a tool that sends on your behalf.
Questions
Both tell receivers that unlisted servers are not allowed. ~all (soft fail) is the safer start; move to -all once you are sure every legitimate sender is listed, and rely on DMARC for the final policy.
No. Gmail, Yahoo, and Outlook expect SPF, DKIM, and DMARC together from bulk senders. SPF breaks when mail is forwarded; DKIM survives forwarding.
More from Infiara
Infiara Where Intelligence Meets Reach.
Connect a mailbox. Import a list. Write once. Launch. Let the inbox turn replies into work.
Infiara AI
Online · Fully AI email automation
