Email fraud and spam are huge problems, and of course you don't want your emails to land in the spam folder or someone to abuse your domain name to send fake messages. This is where an SPF record comes in! In this article I explain in plain terms what an SPF record is, why it's so important and how to set it up correctly.

What is an SPF record?

SPF stands for Sender Policy Framework and is an email authentication technique that lets you specify which mail servers are authorized to send email on behalf of your domain name. This prevents malicious parties from using your domain name for spoofing attacks (sending fake emails as if they came from you).

In short: an SPF record is a kind of "agreement list" that states which servers are allowed to send email on behalf of your domain and which are not.

How does an SPF record work?

When you send an email, the receiving mail server checks whether your sending server is listed in your domain name's SPF record. This works as follows:

  1. The receiving server looks up the sender's SPF record (your domain).
  2. Is the sending server listed in that record? Then the email is considered legitimate.
  3. Is the server not listed? Then the email may be rejected or marked as spam.

Why is an SPF record important?

A correctly configured SPF record helps you with:

✅ Protection against spoofing: cybercriminals can't simply abuse your domain name for phishing or spam.
✅ Better email deliverability: your emails are less likely to end up in the spam folder.
✅ A better reputation for your domain: providers such as Gmail, Outlook and Yahoo trust your domain more.

⚠️ Note: an incorrectly configured SPF record can actually cause your emails not to arrive. And that's something you want to avoid!

Step 1: Check whether you already have an SPF record

Before you add an SPF record, it's smart to check whether you already have one. You can do this with an online SPF checker, for example MXToolbox.

Example:
You enter your domain name and get a result like:

v=spf1 include:_spf.google.com ~all

This means that only Google's mail servers are allowed to send email on behalf of this domain.

Step 2: Creating an SPF record

An SPF record is a TXT record that you add to your DNS settings. It looks like this, for example:

v=spf1 ip4:192.168.1.1 include:_spf.example.com ~all

Let's break this down:

  • v=spf1 → Indicates that this is an SPF record.
  • ip4:192.168.1.1 → Authorizes this IP address to send email.
  • include:_spf.example.com → Allows mail servers of example.com to send email too.
  • ~all → Soft fail (mail from unauthorized servers may be marked as spam, but is not rejected).

Want only certain mail servers to be allowed to send on behalf of your domain? Then use:

v=spf1 include:_spf.google.com include:_spf.mailhost.com -all

With this you're saying: only Google and Mailhost are allowed to send email. All others are rejected (-all).

Step 3: Adding the SPF record to your DNS

  1. Log in to your domain provider (for example Theory7.net).
  2. Go to the DNS settings.
  3. Add a new TXT record.
  4. For the name, enter your domain name (for example yourdomain.nl).
  5. For the value, enter the SPF record, for example: 
    v=spf1 include:_spf.theory7.net -all
  6. Save the changes and wait a few hours for the changes to take effect.

Step 4: Test your SPF record

To check whether your SPF record works, you can use an SPF checker again, such as:

If everything is set up correctly, you shouldn't see any errors.

❌ Multiple SPF records in your DNS
➡️ You may have only one SPF record per domain. Combine records instead of adding several.

❌ Too many DNS lookups
➡️ An SPF record may trigger a maximum of 10 DNS lookups when it is checked: every include, a, mx, ptr, exists and redirect counts (including those inside nested includes), ip4, ip6 and all do not. Otherwise it may be ignored.

❌ Using +all in your SPF record
➡️ This means that any server may send email on behalf of your domain. Avoid this!

SPF is an important first step, but for even better email security there are two additional techniques:

At Theory7.net our email hosting is optimally configured, so you don't have to worry about SPF, DKIM or DMARC. We make sure your emails always arrive and don't end up on a blacklist.

Want worry-free email hosting? See our email hosting!