How to Configure SPF Records: Email Authentication Setup Guide

Why SPF Matters (Right Now)#

In February 2026, Gmail and Yahoo enforcement of strict email authentication has begun. Emails without proper SPF records are being rejected at unprecedented rates.

The reality: If your SPF record isn't set up correctly, your transactional emails (password resets, confirmations, invoices) are being silently blocked. Customers think your service is broken. You don't know there's a problem until they complain.

This guide walks you through SPF setup in 15 minutes.

What Is SPF and How Does It Work?#

SPF (Sender Policy Framework) is a DNS record that says: "These servers are authorized to send email on behalf of my domain."

The Problem SPF Solves#

Without SPF, anyone can send email that appears to come from your domain:

From: you@yourcompany.com
Reply-To: attacker@attacker.com

The email looks like it comes from your company (bad for phishing). SPF prevents this by validating that the sending server is actually authorized.

How SPF Validation Works#

1. Email arrives at Gmail
2. Gmail checks: "What's the SPF record for yourcompany.com?"
3. SPF record says: "Only mail.yourcompany.com and SendGrid are authorized"
4. Email came from: SendGrid (authorized)
5. Result: SPF passes ✅

Now if attacker.com tries to send email claiming to be from yourcompany.com:

1. Email arrives at Gmail from attacker's server
2. Gmail checks: "Is attacker's server in yourcompany.com's SPF record?"
3. Answer: No
4. Result: SPF fails ❌

SPF Record Format and Syntax#

An SPF record is a DNS TXT record. It has a specific syntax:

v=spf1 [mechanisms] [qualifier]

Let's break this down:

• v=spf1: Version (always start with this)
• [mechanisms]: Defines authorized servers
• [qualifier]: How to handle unauthorized servers

Mechanisms (Common Ones)#

Mechanism	Meaning	Example
include:	Include another domain's SPF	include:_spf.google.com
ip4:	Authorize specific IPv4	ip4:203.0.113.50
ip6:	Authorize specific IPv6	ip6:2001:db8::1
mx	Authorize MX server	mx
ptr	Authorize reverse DNS	ptr (rarely used, avoid)
a	Authorize A record	a

Qualifiers (How to Handle Failures)#

Qualifier	Meaning	Use When
+	Pass (allow)	Explicitly authorized
-	Fail (reject)	Explicitly unauthorized
~	Soft fail (accept but mark)	Default for unauthorized
?	Neutral (no policy)	Rarely used

Real-World Example#

v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.50 ~all

What this means:

• Include Google's SPF record (Gmail)
• Include SendGrid's SPF record (SendGrid)
• Also authorize IP 203.0.113.50 (your office mail server)
• Soft fail (~all) for everyone else (mark as suspicious but don't reject)

Step 1: Identify All Your Email Sending Services#

Before writing your SPF record, list every service that sends email on your behalf:

Questions to answer:

• Do you use Google Workspace?
• Do you use Microsoft 365?
• Do you use SendGrid, Mailgun, or another email service?
• Do you have on-premises mail servers?
• Do you use third-party apps that send email (Zapier, automation tools)?

Write them all down. This is the #1 mistake people make—forgetting a sending service, then emails from that service fail SPF.

Common services and their SPF includes:

# Google Workspace
include:_spf.google.com

# Microsoft 365
include:spf.protection.outlook.com

# SendGrid
include:sendgrid.net

# Mailgun
include:mailgun.org

# Klaviyo
include:klavan.net

# HubSpot
include:hstsrv.net

Step 2: Gather SPF Include Statements#

For each service, find the official SPF include statement (from their documentation, not from random websites).

Official sources:

• Google Workspace: support.google.com
• Microsoft 365: learn.microsoft.com
• SendGrid: sendgrid.com/docs
• Mailgun: mailgun.com/docs

Do NOT trust a blog post or random website for this. Always get the official source.

Step 3: Build Your SPF Record#

Start with:

v=spf1 [mechanisms] ~all

Add each include:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

Add any IP addresses:

v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.50 ~all

Step 4: Publish to DNS#

Access your DNS provider (Cloudflare, GoDaddy, Route 53, etc.) and:

1. Go to DNS Records or TXT Records

2. Add a new TXT record with:

   • Name: @ (or your domain name, depending on provider)
   • Value: Your SPF record
   • TTL: 3600 (1 hour, fine for testing)

3. Save and wait 5-15 minutes for propagation

Step 5: Test Your SPF Record#

Use one of these tools to verify your record is correct:

Free options:

• Nova Uptime Email Health Checker
• MXToolbox
• Zonemaster

What you're looking for:

• ✅ SPF record found
• ✅ No syntax errors
• ✅ Lookup count ≤ 10 (more and it fails)

Step 6: Monitor Over Time#

Publish with ~all (soft fail) initially:

• Week 1: Monitor email delivery
• See if emails go through
• Check spam folder

If all looks good after a week, you can change to -all (hard fail):

v=spf1 include:_spf.google.com include:sendgrid.net -all

Common SPF Mistakes and How to Avoid Them#

Mistake 1: Exceeding 10 DNS Lookups#

SPF spec limits DNS lookups to 10. If you exceed this, SPF returns PermError (permanent failure) and emails are rejected.

How to fix:

• Replace include: with ip4: where possible
• Use SPF flattening tools
• Consolidate email services (fewer services = fewer includes)

Mistake 2: Using +all Instead of -all or ~all

+all means "accept anyone claiming to be this domain"—it defeats SPF.

Correct usage:

• ~all: Soft fail (mark as suspicious but deliver)
• -all: Hard fail (reject)

Use ~all initially, then move to -all after verifying.

Mistake 3: Multiple SPF Records#

DNS spec allows only ONE TXT record per name. If you create multiple SPF TXT records, DNS reads only the first one—the others are ignored.

Correct approach:

• Create ONE SPF record
• Combine all mechanisms into it:

v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.50 ~all

NOT three separate records.

Mistake 4: Typos in Include Statements#

include:sendgrid.com vs include:sendgrid.net—one character wrong breaks everything.

Fix:

• Copy-paste from official documentation, don't type manually
• Verify with DNS tool after publishing

Mistake 5: Forgetting a Sending Service#

You add SendGrid SPF but forget about Klaviyo. Klaviyo emails fail SPF.

Fix:

• Audit ALL services that send email
• Add every single one

SPF vs DKIM vs DMARC#

SPF is one part of email authentication. For complete protection, you need all three:

• SPF: "Is the sending server authorized?"
• DKIM: "Is the message content authentic (not forged)?"
• DMARC: "Do both pass AND does the domain align?"

Nova Uptime monitors all three automatically. Check your email health with Nova Uptime's Email Health Checker.

Testing SPF Works in Real Scenarios#

After publishing SPF:

1. Send test emails from your domain
2. Check headers: Look for SPF: PASS or SPF: FAIL
3. Monitor spam folder: Emails still going to spam? Check DKIM/DMARC
4. Use email verification tools: Forward to temporary email services that show headers

Summary#

1. List all email sending services
2. Get official SPF includes from each
3. Combine into one SPF record starting with ~all
4. Publish to DNS TXT record
5. Test with email verification tools
6. Monitor for 1 week
7. Change to -all if everything works
8. Add DKIM and DMARC for complete authentication

Your email reputation is built over months and destroyed in days. Proper SPF configuration is the foundation.

Monitor your email health automatically with Nova Uptime's Email Health Checker—it audits SPF, DKIM, DMARC, MX records, and blacklist status. 🚀

Related Reading#

• SPF Record Setup & Check Guide — Step-by-step SPF setup for beginners
• SPF, DKIM & DMARC Complete Guide — How SPF fits into the full authentication stack
• Email Blacklist Check & Removal Guide — Blacklisting from missing SPF
• DMARC Setup: None to Reject — Configure DMARC after SPF is ready
• Email Health Checker Guide — Comprehensive email authentication audit
• Free SPF Checker — Validate your SPF record instantly