inspect.ZONE Delegation-aware DNS Reports Knowledgebase

SPF: authorizing who can send your mail

Published September 4, 2026. Updated September 9, 2026.

An SPF (Sender Policy Framework) record is a TXT record that lists which servers are allowed to send email using your domain. Receiving mail servers check it to help decide whether a message is really from you.

Why it matters

Without SPF, anyone can put your domain in the "from" address of a message and many receivers have no easy way to tell. With SPF, receivers can see that a sending server is not authorized and treat the message with suspicion. SPF is also one of the two records DMARC relies on.

What the report checks

That a single SPF record exists and is syntactically sane. Two SPF records, or none, is a problem: receivers ignore a domain with more than one, and treat a missing one as unauthenticated.

How to fix it

Publish one TXT record at your domain (the apex) that starts with v=spf1 and lists your senders, ending with -all (reject others) or ~all (soft-fail). For example, a domain that sends only through Google Workspace might use:

v=spf1 include:_spf.google.com -all

Add an include: for each mail provider you use (your host, a newsletter service, a ticketing system). Keep it to one record and under ten DNS lookups.

  • cPanel: Email Deliverability, or the Zone Editor, has an SPF helper.
  • Cloudflare: DNS, add a TXT record on the apex.

How to verify

dig example.com TXT +short

Look for exactly one line beginning v=spf1. Send a test message and check the receiving side's headers for spf=pass.

Common mistakes

  • Two SPF records. Only one TXT record may start with v=spf1; a second one makes receivers treat SPF as broken. If you need more senders, merge them into one record with more include: terms.
  • Too many DNS lookups. SPF allows at most 10 DNS lookups (each include:, a, mx, ptr, exists counts). Past that, SPF returns permerror and fails. Flatten or drop unused includes.
  • Ending with +all. That authorises the entire internet and defeats the point. Use -all (reject) or ~all (soft-fail) once you are confident your senders are listed.
  • Forgetting a sender. A newsletter tool, ticketing system, or your own server that is not in the record will fail SPF. List every legitimate source.

See also