How to Create an SPF Record for Your Domain

Email authentication plays a major role in modern email deliverability and domain security. One of the first and most important authentication methods every domain owner should configure is SPF.

SPF helps mailbox providers verify whether an email server is authorized to send emails on behalf of your domain. Without SPF, attackers can spoof your domain more easily, and your legitimate emails may land in spam folders.

In this complete guide, you’ll learn:

• What SPF is
• How SPF works
• How to create an SPF record
• SPF syntax explained
• Common SPF errors
• Best practices for setup

You can also use the free tools from LeadCanal to generate and test your records:

• SPF Generator
• SPF Checker
• DMARC Checker
• DKIM Checker

What is SPF?

SPF stands for Sender Policy Framework. It is an email authentication protocol designed to prevent unauthorized mail servers from sending emails using your domain.

SPF works through DNS records that specify which servers are allowed to send emails on your behalf.

When mailbox providers like Google Workspace or Microsoft 365 receive an email, they check your SPF record to determine whether the sending server is authorized.

If the server is not listed, SPF may fail.

Why SPF Matters

SPF is important because it improves both email security and email deliverability.

Without SPF:

• Your domain can be spoofed
• Attackers can impersonate your business
• Emails may land in spam folders
• Your domain reputation may decline

With proper SPF setup:

• Receiving servers trust your emails more
• Spoofing risks are reduced
• Deliverability improves
• Email authentication becomes stronger

SPF is especially important for:

• Cold email outreach
• Marketing campaigns
• SaaS notifications
• Transactional emails
• Business communications

SPF Record Syntax Explained

An SPF record is published as a TXT record inside your DNS settings.

Basic SPF example:

v=spf1 include:_spf.google.com ~all

Each part of the record has a specific meaning.

v=spf1

This identifies the TXT record as an SPF record.

Example:

v=spf1

Every SPF record must begin with this tag.

ip4

The ip4 mechanism authorizes specific IPv4 addresses to send emails.

Example:

v=spf1 ip4:192.168.1.1 ~all

This means the listed server IP is allowed to send mail for the domain.

include

The include mechanism authorizes third-party providers.

Example:

include:_spf.google.com

This is commonly used for:

• Google Workspace
• Microsoft 365
• Mailchimp
• SendGrid

If you use external platforms to send emails, you usually need include statements.

~all

The ~all mechanism means soft fail.

Example:

~all

This tells receiving servers:

• Unauthorized senders are probably not allowed
• Emails may still be accepted
• Messages may be marked suspicious

Soft fail is recommended during initial setup.

-all

The -all mechanism means hard fail.

Example:

-all

This tells mailbox providers:

• Reject all unauthorized senders

Hard fail offers stronger protection but should only be used after proper testing.

How SPF Authentication Works

When an email is received, the receiving server performs several checks.

Step 1: Extract Sender Information

The receiving server reads:

• Return-Path domain
• Sending server IP address

Step 2: DNS Lookup

The server checks the domain’s SPF record in DNS.

Example lookup:

v=spf1 include:_spf.google.com ~all

Step 3: Verify Authorization

The receiving server checks whether the sender IP is authorized.

If authorized:

• SPF passes

If unauthorized:

• SPF fails

Creating an SPF Record

Creating an SPF record depends on your email providers and sending services.

Google Workspace Example

If your business uses Google Workspace, your SPF record may look like this:

v=spf1 include:_spf.google.com ~all

v=spf1 include:_spf.google.com include:sendgrid.net ~all

v=spf1 include:a.com include:b.com include:c.com include:d.com ~all

v=spf1 include:_spf.google.com ~all

v=spf1 include:sendgrid.net ~all