An SPF record is a DNS TXT record published at the root of a domain, listing servers authorized to send emails on its behalf. Its value starts with v=spf1, includes sending services via include: directives, and ends with a policy mechanism (~all or -all). Without SPF, a domain is easily spoofed and its deliverability drops 15-30 points on major mailboxes. Unlike broader cold email best practices covering content, the SPF record concerns the technical authentication layer. Since February 2024, Google and Yahoo explicitly require it for any sender above 5,000 emails/day. This article details the exact structure of an SPF record, the step-by-step DNS creation procedure, limits to respect, verification tools, and 3 FAQ.
For a CTO, IT admin, growth marketer, or founder setting up B2B domain deliverability, this article covers concrete DNS TXT creation and validation.
On the agenda:
- Anatomy of an SPF record (mechanisms and modifiers)
- Create the TXT record step by step (DNS)
- Choosing between
~alland-all - The 10 DNS lookups limit
- SPF Flattening to exceed the limit
- Verify the record (MXToolbox, dig, nslookup)
- Classic mistakes to avoid
- B2B cold email use case
- 3 FAQ (multi-services, subdomains, propagation time)
Key takeaways:
- Format: TXT record at
@level (domain root), starting withv=spf1 - Only 1 SPF record per domain: two records = validation failure
- Maximum 10 DNS lookups: beyond, SPF silently invalid
- Main mechanisms:
include:(third-party services),ip4:(direct IPs),aandmx(existing DNS records) - Final policy:
~all(softfail) at startup,-all(hardfail) after 30 days stable - Verification: MXToolbox SuperTool or
dig TXT domain.comcommand - Propagation: 5 minutes to 48h depending on TTL and DNS cache
1. Anatomy of an SPF record
An SPF record follows precise syntax with 3 blocks.
Block 1: version
Each record must start with v=spf1. No v2 is widely deployed.
Block 2: authorization mechanisms
Each mechanism specifies an authorized sender type:
include:another-domain.com: authorizes servers declared in cited domain’s SPF (most used for Google, Sendgrid, Mailchimp, etc.)ip4:192.0.2.1: authorizes specific IPv4ip4:192.0.2.0/24: authorizes IPv4 rangeip6:2001:db8::/32: authorizes IPv6 rangea: authorizes IPs from main domain A recordmx: authorizes IPs from domain MX recordsa:mail.other.com: authorizes another domain’s A record
Block 3: final policy mechanism
+all: authorizes everything (NEVER use, invalidates SPF)?all: neutral (barely useful)~all: softfail — non-authorized accepted but marked suspicious-all: hardfail — non-authorized rejected
Complete example
v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.5 ~allThis record authorizes: Google Workspace servers, Sendgrid servers, and IP 203.0.113.5. Any other sender is softfail marked.
2. Create the TXT record step by step
Step 1: identify sending services
Inventory all services sending emails on the domain’s behalf. Sources not to forget:
- Main email provider (Google Workspace, Microsoft 365, Zoho Mail)
- Cold email / sequences tool (Lemlist, Instantly, Smartlead, Zeliq, Outreach)
- Marketing automation (HubSpot, ActiveCampaign, Mailchimp)
- Transactional (Sendgrid, Amazon SES, Postmark, Mailgun)
- CRM with integrated email (Salesforce, Pipedrive)
- Billing / e-commerce (Stripe, Shopify)
Each service provides in its documentation the include: mechanism to integrate.
Step 2: build the record value
Assemble in order: v=spf1 → mechanisms → final policy.
Example for Google Workspace + Sendgrid + Lemlist:
v=spf1 include:_spf.google.com include:sendgrid.net include:_spf.lemlist.com ~allStep 3: publish in DNS manager
Connect to the registrar or DNS manager (Cloudflare, Route 53, GoDaddy, Google Domains, Gandi, IONOS). Add a record with:
- Type: TXT
- Name / Host:
@(domain root) - Value: full SPF string
- TTL: 3600 sec (1 hour) recommended, or 300 sec if tests ongoing
Step 4: wait for propagation
Depending on TTL and DNS cache, propagation takes 5 minutes to 48h. Cloudflare and Route 53 propagate in 1-10 minutes typically, older registrars (GoDaddy) can take 30-60 minutes.
Step 5: test
Use MXToolbox SPF Check or command line:
dig +short TXT your-domain.comResult must include correctly formed SPF record.
3. Choosing between ~all and -all
Softfail ~all (recommended at startup)
Unlisted servers accepted but marked suspicious. Useful during first 30 days of setup: if a forgotten service still sends, emails aren’t rejected, just marked. Allows discovering oversights via logs without breaking production.
Hardfail -all (stable production)
Unlisted servers categorically rejected. Switch after 30 days observation with ~all and confirmation via DMARC reports that 99%+ of sends pass. Provides maximum protection against spoofing.
Never use +all or ?all
+all invalidates SPF (authorizes any server), ?all removes all policy. These values are SEO audit signs to fix immediately.
4. The 10 DNS lookups limit
RFC 7208 imposes a maximum of 10 DNS lookups for SPF record resolution. Each include:, a, mx, redirect=, or exists: counts as 1 lookup; some chained include: count 2-3 in cascade.
Count lookups
Problematic example:
v=spf1 include:_spf.google.com include:sendgrid.net include:_spf.lemlist.com include:_spf.hubspot.com include:_spf.mailchimp.com include:_spf.brevo.com include:_spf.mailgun.org include:_spf.instantly.ai include:_spf.smartlead.ai include:_spf.pipedrive.com ~all10 include: = potentially 15-20 actual lookups (each service chains others) → broken SPF silently, all mails marked suspicious by Gmail/Outlook.
Lookup counter tools
- DMARCLY SPF Checker: precisely counts lookups
- EasyDMARC SPF Checker: same + optimization suggestions
- MXToolbox SPF Record Lookup Count: free, fast
5. SPF Flattening to exceed the limit
If a domain exceeds 10 lookups, two options:
Option A: reduce services
Remove unnecessary integrations. An annual include: audit often reveals 2-3 abandoned but left services in SPF.
Option B: SPF Flattening
A third-party service resolves all include: upstream and publishes a record with direct IPs (ip4:) instead of include:. Services: DMARCLY, EasyDMARC, Sender Score.
Before flattening:
v=spf1 include:_spf.google.com include:sendgrid.net include:_spf.lemlist.com ~allAfter flattening (TXT record at DMARCLY):
v=spf1 ip4:35.190.247.0/24 ip4:64.233.160.0/19 ip4:167.89.0.0/17 ip4:213.239.4.0/24 ~allFlattening avoids lookup overrun but forces monitoring provider IP changes (DMARCLY does automatically).
6. Verify the record
MXToolbox SuperTool
mxtoolbox.com/spf.aspx. Enter domain, click « SPF Record Lookup ». Tool displays: record found, valid syntax, lookup count, mechanisms detected, warnings.
Command line
dig +short TXT your-domain.com | grep spf1Or on Windows:
nslookup -type=TXT your-domain.comReal send test
Send an email to check-auth@verifier.port25.com or mailtest@unlocktheinbox.com. Automated reply details SPF, DKIM, DMARC with verdict.
Mail-Tester
mail-tester.com generates unique address, send email there. Score out of 10 with SPF breakdown included.
7. Classic mistakes
Mistake 1: two SPF records
A domain can only have one SPF record. Two = silently invalid SPF. Often caused by a v=spf1 include:_spf.google.com ~all created during Google Workspace setup, then a second v=spf1 include:sendgrid.net ~all added for Sendgrid. Merge into one.
Mistake 2: 10 lookups overrun
Most frequent cause of broken SPF on domains with 5+ services. Mandatory diagnosis via MXToolbox.
Mistake 3: +all or missing final mechanism
SPF without final all is ambiguous; +all invalidates all protection. Always end with ~all or -all.
Mistake 4: forgotten outbound subdomain
Sending cold email from @domain.com risks contaminating main domain reputation. Create dedicated subdomain (@outreach.domain.com) with own SPF + DKIM + DMARC.
Mistake 5: invisible characters copy-pasted
Copy-paste from a PDF or formatted doc can introduce invisible Unicode characters (typographic quotes, non-breaking spaces). Always retype the record in plain text if SPF fails without apparent reason.
Zeliq and SPF integration for deliverability
Zeliq combines a 450 million B2B contact database, waterfall enrichment, multichannel sequences, and integrated email verification that filters invalid addresses before send. A reduced bounce rate directly protects domain reputation and the durable validity of its SPF record.
8. B2B cold email use case
For an SDR team sending B2B cold email, standard SPF config on a dedicated subdomain:
v=spf1 include:_spf.google.com include:_spf.zeliq.com ~allThen after 30 days observation via DMARC reports:
v=spf1 include:_spf.google.com include:_spf.zeliq.com -allDedicated subdomain (outreach.domain.com) isolates main domain reputation; if a campaign is spam-flagged, only subdomain is impacted.
Volume and alignment: an SDR sends 50-100 emails/day, a 5-10 SDR team reaches 500-1000/day on subdomain. Well below the 5,000 threshold but with the same Google/Yahoo requirement since 2024.
9. Frequently asked questions
How to manage multiple sending services in a single SPF record?
Each service is added via an include: mechanism in main usage order, respecting the 10 DNS lookups total maximum. The rule: only one SPF record per domain. To add Google Workspace + Sendgrid + Lemlist + HubSpot, write v=spf1 include:_spf.google.com include:sendgrid.net include:_spf.lemlist.com include:_spf.hubspot.com ~all. include: order doesn’t influence SPF validation (each mechanism evaluated), but influences admin readability. Convention: put highest-volume service first. Watch cascading includes: include:_spf.hubspot.com can include itself 3-4 sub-includes, consuming 4-5 lookups instead of 1. MXToolbox SPF Record Lookup Count displays real total. If domain approaches 10 lookups, two strategies: (1) segment by subdomain (marketing on mkt.domain.com, cold on outreach.domain.com, corporate on domain.com), each subdomain having its own shorter SPF; (2) SPF Flattening via DMARCLY or EasyDMARC that resolves all includes to direct IPs. Subdomain segmentation is cleaner long-term as it also isolates reputations.
Should I create an SPF record for each subdomain?
Yes if the subdomain sends emails, no if it doesn’t; by default a subdomain doesn’t inherit parent domain SPF. DNS treats each zone as independent. A v=spf1 include:_spf.google.com ~all on domain.com doesn’t apply to outreach.domain.com. Use case: main domain domain.com sends corporate emails via Google Workspace, subdomain outreach.domain.com sends cold email via Zeliq. Two TXT records needed: one on @ (main domain) with include:_spf.google.com, one on outreach with include:_spf.zeliq.com. Conversely, subdomain www.domain.com only used for web hosting (no email send) needs no SPF. Proactive best practice: on subdomains never sending emails, publish an explicitly empty SPF v=spf1 -all to block any spoofing attempt from this subdomain. Protects against spoofing attacks using unused subdomains as vector.
How long does SPF record propagation take?
Between 5 minutes and 48 hours depending on record TTL, registrar used, and DNS cache of receiving mailboxes. TTL (Time To Live) is duration external DNS server caches the response. TTL 300 sec = external caches refresh every 5 min; TTL 86400 sec (24h) = refresh once/day. For quick modification: lower TTL to 300 sec 48h before planned change, apply modification, test after 15 min via MXToolbox, raise TTL back to 3600 sec after stabilization. Registrar also matters: Cloudflare propagates to public DNS (Google 8.8.8.8, Cloudflare 1.1.1.1, OpenDNS) in 1-5 minutes typically, Route 53 in 5-10 minutes, GoDaddy in 15-60 minutes. Finally, mailbox-side cache: Gmail and Outlook cache SPF records 4 to 24 hours. Email sent right after SPF change may be evaluated against old record for several hours. Never leave broken SPF over 24h: mailboxes fallback on old cache but absorb error, recurring modification creates reputation instability.
10. Conclusion: 3 actions to run
Audit current SPF record within 7 days via MXToolbox SPF Record Lookup Count. Verify valid syntax, lookups count under 10,
~allor-allpresence. Fix if overrun.Inventory all sending services within 15 days. Exhaustive Google Workspace, cold tool, marketing automation, transactional, CRM list. Add missing
include:or remove obsolete.Switch from
~allto-allwithin 30 days observation. Confirm via DMARC reports that 99%+ of sends pass SPF before hardening policy.
Protect durable SPF validity with integrated email verification
Zeliq combines 450 million B2B contacts, waterfall enrichment with integrated email verification, and multichannel sequences. Bounce rate reduced to 1-3%, domain reputation preserved. Account created in 2 minutes.
Try for freeAnd if you want your SPF record to stay effective over time with upstream email verification, try Zeliq for free: sourcing, verification, and multichannel sequences in one interface, no credit card required.
