How to Fix Your SPF Record — Step by Step

What is an SPF Record?

An SPF record is a DNS TXT record published on your domain. It lists the servers and IP addresses authorized to send email for that domain. When a receiving server gets an email claiming to be from your domain, it checks your SPF record. If the sending server is not listed, the email may be marked as spam or rejected.

A typical SPF record looks like this:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Step 1: Check Your Current SPF Record

Before fixing anything, you need to see what you currently have. Use a DNS lookup tool (or the CheckFast Email Checker) to retrieve your domain's TXT records. Look for the entry that starts with v=spf1.

Common issues you may find at this stage: no SPF record at all, multiple SPF records (only one is allowed), or a record that exceeds 255 characters without being properly split.

Step 2: Validate the Syntax

SPF syntax is strict. The record must begin with v=spf1 and end with a catch-all mechanism. The three common catch-all options are:

• -all — Hard fail. Reject anything not explicitly authorized. Strictest option.
• ~all — Soft fail. Accept but mark as suspicious. Most commonly used.
• ?all — Neutral. SPF result is neither pass nor fail. Rarely useful.

Avoid using +all — it authorizes every server on the internet, making your SPF record useless.

Step 3: Count Your DNS Lookups

The SPF specification (RFC 7208) limits you to 10 DNS lookups per SPF evaluation. Each of these mechanisms triggers a lookup: include, a, mx, ptr, exists, and redirect.

Nested includes count too. If your record includes Google Workspace, SendGrid, Mailchimp, HubSpot, and Zendesk, you can easily exceed 10 lookups because each of those services has its own nested includes.

When you exceed the limit, SPF evaluation returns a permerror, and receiving servers treat it as if SPF failed completely.

Step 4: Flatten or Consolidate

If you are over the 10-lookup limit, you have a few options:

• Flatten includes — Replace include: directives with the actual IP ranges they resolve to (using ip4: and ip6: mechanisms). This removes the DNS lookup. The downside is you need to update these if the provider changes their IPs.
• Remove unused services — If you stopped using a service, remove its include directive.
• Use subdomains — Send transactional email from a subdomain like mail.yourdomain.com with its own SPF record.

Step 5: Publish and Verify

Once you have crafted the corrected SPF record, update the TXT record in your DNS provider (Cloudflare, Route 53, GoDaddy, etc.). Remember that DNS changes can take up to 48 hours to propagate, though most providers update within minutes.

After publishing, verify the record using CheckFast's Email Checker or the DNS Checker to confirm it resolves correctly and passes validation.

Common SPF Mistakes

• Publishing two SPF records — only one TXT record starting with v=spf1 is allowed per domain.
• Using the deprecated ptr mechanism.
• Forgetting to include your transactional email provider.
• Not coordinating SPF with DKIM and DMARC — all three work together.