How to Set Up an SPF Record for Your Domain

1. List every service sending mail from your domain (Mailchimp, Google Workspace, own server, Yandex Mail Pro)
2. Open your registrar's DNS panel (REG.RU, Timeweb, Cloudflare)
3. Create a TXT record with name @ (domain apex)
4. Value: v=spf1 include:provider1 include:provider2 -all
5. Wait for propagation (up to 24 hours)
6. Verify via Enterno DNS Checker — enter domain, select TXT
7. Send a test email to check-auth@verifier.port25.com — receive an auto-report

• Multiple SPF records on the same domain = invalid (RFC 7208). Merge into one.
• More than 10 DNS lookups (via include) → SPF permerror. Count nested includes.
• +all instead of -all allows any source and defeats SPF
• SPF is not needed to receive mail — only to send from the domain
• Forgetting to add a new provider (e.g. Sendinblue) → mail goes to spam

To set up an SPF record, create a TXT record in your DNS settings with the format v=spf1 include:example.com -all. Replace example.com with your domain or the domains of your email service providers. This record specifies which mail servers are permitted to send emails on behalf of your domain, enhancing email security and deliverability.

Sender Policy Framework (SPF) is an email authentication protocol designed to prevent spammers from sending messages on behalf of your domain. An SPF record is a type of DNS record that lists the IP addresses or hostnames of authorized mail servers for your domain. When an email is sent, the receiving mail server checks the SPF record to verify that the email comes from an authorized source.

SPF records are crucial for maintaining your domain's reputation and ensuring that your emails reach their intended recipients. Without a proper SPF record, your emails are more likely to be flagged as spam or rejected entirely. The SPF specification is defined in RFC 7208.

Components of an SPF Record

An SPF record typically consists of several components, including:

• Version: This indicates the SPF version used, typically v=spf1.
• Mechanisms: These specify which IP addresses or domains are authorized. Common mechanisms include:
• ip4: Specifies an IPv4 address or range.
• ip6: Specifies an IPv6 address or range.
• include: Allows the inclusion of another domain's SPF record.
• all: Matches any source, typically used at the end of the record.
• Modifiers: Optional parameters that provide additional instructions, such as exp: for explanations.

For example, a simple SPF record might look like this:

v=spf1 ip4:192.0.2.1 include:mail.example.com -all

This record indicates that emails from your domain can be sent from the IP address 192.0.2.1 and any server listed in mail.example.com.

Setting up an SPF record involves several steps, from accessing your DNS settings to verifying the configuration. Follow this detailed guide to ensure proper implementation:

1. Access Your DNS Management Console: Log in to your domain registrar or hosting provider where your DNS is managed. This may be services like GoDaddy, Namecheap, or Cloudflare.
2. Locate the DNS Settings: Navigate to the DNS management section. This may be labeled as DNS Settings, DNS Management, or Zone File Settings.
3. Add a New TXT Record: Create a new TXT record. The fields typically include:
• Name: Enter your domain or subdomain (e.g., @ for the root domain).
• Type: Select TXT.
• Value: Enter your SPF record (e.g., v=spf1 ip4:192.0.2.1 include:mail.example.com -all).
4. Save Your Changes: Ensure to save or apply the changes in your DNS settings. DNS propagation may take anywhere from a few minutes to 48 hours.
5. Verify Your SPF Record: Use tools like MXToolbox or Kitterman SPF Validator to check the validity of your SPF record. Input your domain and analyze the results.
6. Monitor Email Deliverability: After setting up your SPF record, monitor your email deliverability. Use analytics tools to track email performance and adjust your SPF record as necessary.

For example, if you're using Google Workspace for your email, your SPF record may look like this:

v=spf1 include:_spf.google.com ~all

This configuration allows Google’s servers to send emails on behalf of your domain while marking other sources as suspect.