What is SPF?

SPF is a TXT record in your domain’s DNS that lists the servers allowed to send email in your domain’s name. When a server receives mail from an address like you@example.com, it checks that list; if the sender is not on it, the mail looks suspicious.

Why it matters

Without SPF anyone can send forged mail in your name, and your real mail is more likely to land in spam. Since 2024 Gmail and Yahoo ask every sender for at least SPF or DKIM, and bulk senders for both plus DMARC.

Write one correct record

1. List every service that sends mail for your domain: your main mailbox provider (such as Google Workspace or Microsoft 365), newsletter tools, your online shop and your site’s forms.
2. Take each service’s include from its own documentation: include:_spf.google.com for Google and include:spf.protection.outlook.com for Microsoft 365.
3. Put them all in one record, one after another, and end it with ~all; see the example below.
4. In your domain’s DNS panel (Cloudflare or your registrar, for example), create a record of type TXT, name @, with that value.
5. Wait a few minutes and check the domain again on CheckNet’s DNS page; the SPF row should turn blue.

v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

Three common problems and their fixes

• No record: create the record above. If the domain sends no mail at all, use v=spf1 -all so no server can send in its name.
• More than one record: the standard allows only one SPF record, and with two the SPF check fails outright. Merge all the includes into one record and delete the other.
• Ending in +all: that allows every server in the world, which makes SPF useless. Change it to ~all or -all.

The ten-lookup limit: every include, a or mx in the record costs a DNS lookup, and more than ten makes SPF fail. Remove services you no longer use.

~all or -all?

With ~all, mail from an unlisted server is marked suspicious; with -all it is rejected. If you are not sure you listed every sender, start with ~all and move to -all once DMARC is set up and its reports look clean.

Check it with CheckNet

On CheckNet’s DNS page, the SPF row shows the record’s value under it. If you still see the old record, wait a little: DNS changes take minutes to hours, depending on the record’s TTL.