SPF Record

SPF (Sender Policy Framework) is a TXT record in a domain's DNS that lists the servers allowed to send email on its behalf. The receiving server checks the sender's IP against this list and decides whether to trust the message. Without SPF, Gmail and Mail.ru send more of your email to spam, and scammers can send mail in your name.

Below you'll find ready-made SPF records for Yandex 360, VK WorkSpace, Google Workspace and Microsoft 365, plus a list of errors that silently break SPF.

At a glance: SPF in numbers

Fact	Value	Source
Standard	RFC 7208, 2014	IETF
Maximum DNS lookups during evaluation	10, otherwise the result is permerror	RFC 7208, section 4.6.4
Maximum “void” DNS lookups	2	RFC 7208, section 4.6.4
SPF records per domain	exactly one	RFC 7208
Gmail requirement for all senders	SPF or DKIM; from 5,000 emails a day, SPF, DKIM and DMARC	Google, 2024
Mail.ru requirement	SPF, DKIM and DMARC must all pass	Mail.ru

How an SPF record works

The check takes a fraction of a second and runs in four steps:

1. Your server sends an email with a sender address on the company.com domain.
2. The receiving server looks up the TXT record for company.com that starts with v=spf1.
3. It compares the sender's IP with the list of allowed servers.
4. It writes the result into the email headers: pass, fail, softfail, neutral or permerror.

Important: SPF checks the technical sender address (Return-Path), not the From address the recipient sees. DMARC is what links the two. That's why SPF alone isn't enough: you also need DKIM and DMARC.

What an SPF record is made of

A record is a single string with a version, mechanisms and a final rule. Example: v=spf1 include:_spf.google.com ip4:203.0.113.10 ~all.

Element	Meaning	Costs a DNS lookup
v=spf1	Version, always first	No
ip4: / ip6:	A specific IP or subnet	No
a	IPs from the domain's A record	Yes
mx	Servers from the domain's MX records	Yes
include:	Servers from another domain's SPF (your mail provider)	Yes, plus nested ones
redirect =	Use another domain's SPF entirely	Yes
-all	Reject all other servers (fail)	No
~all	Treat all others as suspicious (softfail)	No
?all / +all	Neutral / allow everyone	No

Never use +all: it allows any server on the internet to send email in your name.

~all or -all: which to choose

Start with ~all and switch to -all once you're sure the record lists every service that sends email from the domain.

• ~all is safer: if you forgot your CRM or sending tool, its emails will be treated as suspicious but not rejected outright.
• -all is stricter and better against spoofing, but any forgotten system will stop delivering email.

For cold outreach domains where only one provider sends mail, you can use the strict rule from the start.

How to set up SPF in 10 minutes

1. List your senders. Mail provider, CRM, sending tool, website forms — everything that sends email from your domain.
2. Check for an existing SPF record. In your DNS panel, look for a TXT record starting with v=spf1. If there is one, edit it instead of adding a second.
3. Build the record from the templates below: one v=spf1, all include: entries and one final ~all or -all.
4. Add the TXT record for the root of the domain (host @) at your registrar or DNS provider.
5. Wait for DNS to update — usually from a few minutes to a few hours, depending on the TTL.
6. Check the result: send an email to Gmail and look for SPF: PASS under “Show original”.

In Holymailer you can skip this step: SPF, DKIM, DMARC and MX are configured automatically when you register or delegate a domain, and are checked daily.

Ready-made SPF records for popular mail providers

Copy the line for your provider and check it against the provider's current documentation before publishing it to DNS.

Provider	TXT record for host @
Yandex 360	v=spf1 redirect=_spf.yandex.net
VK WorkSpace (Mail.ru)	v=spf1 redirect=_spf.mail.ru
Google Workspace	v=spf1 include:_spf.google.com ~all
Microsoft 365	v=spf1 include:spf.protection.outlook.com -all
Google Workspace + sending tool	v=spf1 include:_spf.google.com include:[domain from the tool's docs] ~all
Yandex 360 + your own server	v=spf1 include:_spf.yandex.net ip4:[server IP] ~all
Domain that doesn't send email	v=spf1 -all

redirect= only works when a single service sends your email. If there are several, replace it with include: and add ~all at the end.

7 errors that break SPF

Error	What happens	How to fix
Two SPF records on one domain	The check returns permerror	Merge them into one line
More than 10 DNS lookups	permerror, SPF counts as failed	Remove unused includes, replace a and mx with ip4
Forgot the sending tool or CRM	Its emails get softfail or fail	Add the include from the service's docs
+all at the end	Anyone can send in your name	Replace with ~all or -all
Record on the wrong host	Result is none	Add it for @ or the right subdomain
Sending from a subdomain without its own record	SPF isn't inherited by subdomains	Create SPF for every sending subdomain
Typos: space after a colon, two all's, quotes inside	permerror	Check the record with an SPF validator

How to check an SPF record

Three ways, from simple to technical:

• Email headers. In Gmail, open “Show original”. SPF: PASS means everything is fine. Mail.ru describes the same check in its developer help (in Russian).
• Terminal command. nslookup -type=txt company.com or dig TXT company.com +short shows the published record.
• Online SPF validator. It counts DNS lookups and finds syntax errors.

Frequently asked questions

What is an SPF record in simple terms?

It's a list of servers allowed to send email from your domain. It lives in DNS as a TXT record, and mailbox providers check it for every incoming email.

Can a domain have two SPF records?

No. RFC 7208 prohibits multiple SPF records on one domain, and the check will return an error. Combine all services into one line using include.

Which should I choose: ~all or -all?

~all if you're not sure you've listed every sender. -all when the list is definitely complete, for example on a separate outreach domain with a single provider.

How long does an SPF record take to apply?

Usually from a few minutes to a few hours. It depends on the record's TTL and your DNS provider.

Do I need SPF if DKIM is already set up?

Yes. Gmail requires both SPF and DKIM from senders of 5,000+ emails a day, and Mail.ru expects SPF, DKIM and DMARC to pass for all mailings. The mechanisms complement each other.

What does SPF softfail in the headers mean?

The email was sent from a server that isn't in the record, and the record ends with ~all. Add that service via include or ip4.

Sources

• RFC 7208: Sender Policy Framework — the SPF standard, 2014.
• Google: Email sender guidelines — in force since February 1, 2024.
• Mail.ru: technical requirements for mailings (in Russian).
• Mail.ru: how to check SPF, DKIM, DMARC in an email (in Russian).
• Holymailer: capabilities (in Russian).

JSON-LD markup

{ "@context": "https://schema.org", "@graph": [ { "@type": "Article", "inLanguage": "en", "headline": "SPF Record: Set It Up in 10 Minutes + Ready-Made Templates", "author": {"@type": "Person", "name": "[Author name]", "jobTitle": "[Job title]"}, "datePublished": "2026-09-30", "dateModified": "2026-09-30", "publisher": {"@type": "Organization", "name": "Holymailer", "url": "https://holymailer.com"} }, { "@type": "HowTo", "name": "How to set up SPF in 10 minutes", "step": [ {"@type": "HowToStep", "text": "List every service that sends email from your domain."}, {"@type": "HowToStep", "text": "Check whether a TXT record with v=spf1 already exists."}, {"@type": "HowToStep", "text": "Build one record: v=spf1, all include entries and a final ~all or -all."}, {"@type": "HowToStep", "text": "Add the TXT record for host @ at your DNS provider."}, {"@type": "HowToStep", "text": "Wait for DNS to update."}, {"@type": "HowToStep", "text": "Send a test email to Gmail and check for SPF: PASS in the original message."} ] }, { "@type": "FAQPage", "mainEntity": [ {"@type": "Question", "name": "What is an SPF record in simple terms?", "acceptedAnswer": {"@type": "Answer", "text": "It's a list of servers allowed to send email from your domain. It lives in DNS as a TXT record."}}, {"@type": "Question", "name": "Can a domain have two SPF records?", "acceptedAnswer": {"@type": "Answer", "text": "No. RFC 7208 prohibits multiple SPF records on one domain. Combine all services into one line using include."}}, {"@type": "Question", "name": "Which should I choose: ~all or -all?", "acceptedAnswer": {"@type": "Answer", "text": "~all if you're not sure you've listed every sender. -all when the list is definitely complete."}}, {"@type": "Question", "name": "How long does an SPF record take to apply?", "acceptedAnswer": {"@type": "Answer", "text": "Usually from a few minutes to a few hours, depending on the record's TTL and your DNS provider."}}, {"@type": "Question", "name": "Do I need SPF if DKIM is already set up?", "acceptedAnswer": {"@type": "Answer", "text": "Yes. Gmail requires both SPF and DKIM from senders of 5,000+ emails a day, and Mail.ru expects SPF, DKIM and DMARC to pass for all mailings."}}, {"@type": "Question", "name": "What does SPF softfail in the headers mean?", "acceptedAnswer": {"@type": "Answer", "text": "The email was sent from a server that isn't in the record, and the record ends with ~all. Add that service via include or ip4."}} ] } ] }