What is an SPF Record and How to Set One Up

This article explains what SPF records are and how to set one up to authorise email servers for your domain.

What is an SPF Record?

An SPF (Sender Policy Framework) record is a type of DNS record that tells the world which email servers are allowed to send emails from your domain. It's a TXT record that sits at your domain's root (@) and helps prevent spam and email spoofing.

When someone receives an email claiming to be from your domain, their email server checks your SPF record to verify the sender is authorised. Without an SPF record, legitimate emails from your domain might end up in spam folders or be rejected entirely.

How to Set Up an SPF Record

1. Identify Your Email Provider

First, determine which service sends emails from your domain:

Google Workspace (formerly G Suite)
Microsoft 365 (formerly Office 365)
Your web hosting provider
A combination of providers

2. Create Your SPF Record

The basic format of an SPF record is: v=spf1 [mechanisms] [qualifier]

For Google Workspace: v=spf1 include:_spf.google.com -all

For Microsoft 365: v=spf1 include:spf.protection.outlook.com -all

For multiple providers (Google and Microsoft): v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all

3. Choose Your Enforcement Level

The ending qualifier determines how strict your SPF policy is:

-all = Hard fail (strongest protection, recommended)
~all = Soft fail (less strict, emails marked as suspicious but delivered)
?all or +all = Too permissive (not recommended)

4. Add the Record to Your DNS

Web60 Customers (Nameservers):

Log into your Web60 dashboard
Go to Domain Management
Click DNS Records
Use the quick-add buttons for Google Workspace or Microsoft 365, or add manually
Add a TXT record at @ with your SPF value
Change ~all to -all for better protection

Path A Customers: Add the TXT record at your current DNS provider (where you manage your domain's DNS settings).

5. Test Your SPF Record

Use the MXToolbox SPF checker to verify your record is working correctly. You can also check it using the DNS health report which will show PASS, WARN, or FAIL status.

Important Rules

Only one SPF record per domain - Having multiple SPF records will break email delivery completely. If you need multiple providers, combine them into a single record using multiple include: statements.

Test before going live - Always test your SPF record with a tool before making it active, especially when changing from ~all to -all.

If you're still stuck or need help setting up your SPF record, contact Web60 support with details about your email provider.

Frequently asked questions

Can I have multiple SPF records for my domain?

No. Having multiple SPF records will break email delivery completely. You must combine all email providers into a single SPF record using multiple include statements.

What's the difference between -all and ~all in an SPF record?

-all means hard fail (emails from unauthorised servers are rejected), while ~all means soft fail (emails are marked suspicious but still delivered). Use -all for stronger protection.

How long does it take for SPF changes to take effect?

SPF record changes typically take effect within a few minutes to an hour, but can take up to 24 hours to propagate fully across all DNS servers worldwide.

Will an SPF record affect my website?

No. SPF records only affect email authentication and have no impact on your website's functionality or loading speed.

What happens if I don't have an SPF record?

Without an SPF record, legitimate emails from your domain may be marked as spam or rejected by recipient email servers, causing delivery problems.

Can I include Web60's email servers in my SPF record?

Web60 is a web hosting service, not an email provider. Include only the email services you actually use to send emails from your domain, such as Google Workspace or Microsoft 365.

My SPF record shows FAIL in the DNS health check - what's wrong?

A FAIL result usually means your SPF record ends with ?all or +all, which is too permissive. Change it to ~all (acceptable) or -all (recommended) for better security.