Publish an SPF record

Tell mailbox providers which servers are allowed to send email as your domain.

15 min

why this matters

Without SPF, receivers have no way to tell your mail from a spoof, so far more of it is filtered — and Gmail and Yahoo now require authentication from bulk senders.

Step by step

1
List every service that sends as your domain
Your mailbox provider, your marketing platform, your helpdesk, your invoicing tool, your CRM. Missing one means its mail starts failing, so write the list down first.
2
Collect each provider's include value
Every provider documents an SPF include. Common ones: Google Workspace uses _spf.google.com, Microsoft 365 uses spf.protection.outlook.com, SendGrid uses sendgrid.net, Mailchimp uses servers.mcsv.net.
3
Publish one TXT record on the root domain
Combine every sender into a single record. Only one SPF record may exist per domain.
```
Type: TXT
Name: @
Value: v=spf1 include:_spf.google.com include:sendgrid.net -all
```
4
Choose your enforcement
End with -all to have unauthorised mail rejected, or ~all while you are still confirming your sender list. Never use +all — it permits anyone to send as you.