What does an SPF record look like?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
An SPF record is a DNS TXT record that lives on your domain and lists which servers are allowed to send email from it. Here's a typical one:
v=spf1 a mx include:mailchimp.com ip4:192.0.2.44 ~allLet's break that down left to right:
v=spf1: The version tag. This tells receiving servers that this is an SPF record. It's always exactly this and it always goes first.
a: Allows the domain's own A record (its primary IP address) to send mail. Useful if you're sending from your own web server.
mx: Allows mail to come from the IP addresses in your MX records. Common when your incoming and outgoing mail flows through the same server.
include:mailchimp.com. Delegates part of the permission to Mailchimp's own SPF record, meaning Mailchimp's sending IPs are also authorized to send on your behalf. You'll have one of these for every ESP or mail service you use.
ip4:192.0.2.44: Directly authorizes a specific IP address. Used when you're sending from an IP that doesn't fit neatly under any include: or mx mechanism.
~all: The catch-all. This says: anything not explicitly listed should be treated as a "soft fail." The tilde (~) means be suspicious but don't reject outright. The strict version is -all (hard fail, reject it).
Every SPF record must end with an all mechanism. The most common choices are ~all (soft fail, lower risk during setup) and -all (hard fail, stricter enforcement). If you have DMARC in place, -all is generally the right call.
Still one thing to watch: SPF records can't exceed 10 DNS lookups. Every include:, a, and mx mechanism that requires a DNS lookup counts toward that limit. If you're using multiple ESPs, it's easy to hit it. Our free SPF checker will tell you if you're over the limit.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
