Implementation Guides·Updated 2025-07-01·7 min read

How to Configure SPF Correctly

Step-by-step guide to setting up SPF (Sender Policy Framework) for cold email — record format, DNS configuration, common errors, and verification steps.

Quick Answer

Add a TXT record at the root of your domain with the SPF value provided by your email provider. Verify it at MXToolbox. Stay under 10 DNS lookups. For Google Workspace: v=spf1 include:_spf.google.com ~all.

What SPF Does
SPF Record Format
SPF Records by Email Provider
Step-by-Step Configuration
The 10-Lookup Limit
How to Verify SPF

Introduction

SPF (Sender Policy Framework) is a DNS record that tells receiving mail servers which servers are authorized to send email on behalf of your domain. Without it, your cold emails will be flagged as suspicious.

This guide walks through exactly how to configure SPF correctly — what record to add, where to put it, how to avoid the 10-lookup limit, and how to verify it is working.

Who This Guide Is For

• Anyone setting up DNS authentication for cold email
• People who keep seeing SPF errors in their email delivery
• Teams configuring multiple email providers on one domain

Key Takeaways

1. SPF is a TXT record at the root of your domain
2. The record value comes from your email provider, not from examples
3. SPF has a 10 DNS lookup limit — each include counts as one
4. Start with ~all (soft fail) for cold email
5. Verify at MXToolbox after adding the record

What SPF Does

When you send an email, the receiving server checks the SPF record to verify that the sending server is on your authorized list. If the sending server is not listed, SPF fails and the email is more likely to land in spam.

For a deeper understanding of how SPF fits into the authentication picture, see our SPF vs DKIM vs DMARC guide. This guide focuses on the practical setup steps.

SPF Record Format

An SPF record is a TXT record published at the root of your domain (@). The basic format is:

ℹ️ Info

v=spf1 include:_spf.google.com ~all

The v=spf1 prefix identifies it as an SPF record. The include statement lists authorized sending servers. The ~all at the end is the policy for unauthorized servers.

Policy	Meaning	When to Use
-all (hard fail)	Reject unauthorized email	Only after extensive monitoring
~all (soft fail)	Mark unauthorized as suspicious	Recommended for cold email
?all (neutral)	No action on unauthorized	Only during initial testing

SPF Records by Email Provider

Provider	SPF Record Value
Google Workspace	v=spf1 include:_spf.google.com ~all
Microsoft 365	v=spf1 include:spf.protection.outlook.com ~all
Zoho Mail	v=spf1 include:zohomail.com ~all
Google + Cold Email Tool	v=spf1 include:_spf.google.com include:tool.com ~all

⚠️ Warning

Always use the exact SPF value provided by your email provider. Do not copy values from blog posts — providers update their records and the examples may be outdated.

Step-by-Step Configuration

Log in to your domain registrar's DNS management panel
Find the DNS records section (sometimes called DNS Zone Editor)
Create a new TXT record
Set the Host/Name to @ (root domain)
Set the Value to your provider's SPF record
Set TTL to 3600 (1 hour) or default
Save the record
Wait 24–48 hours for DNS propagation
Verify the record at MXToolbox SPF Lookup

📝 Example

DNS management panel showing a TXT record being added with host @ and SPF value.

The 10-Lookup Limit

SPF has a maximum of 10 DNS lookups. Each include statement counts as one lookup. If you exceed 10, SPF will fail with a PermError.

include:_spf.google.com = 1 lookup
include:spf.protection.outlook.com = 1 lookup
include:tool.com = 1 lookup
mx = 1 lookup
a = 1 lookup

If you need to include multiple services, consider using an SPF flattening tool or consolidating services. For most cold email setups, Google Workspace or Microsoft 365 plus one cold email tool stays well under the limit.

How to Verify SPF

Go to mxtoolbox.com/SPFRecordLookup.aspx
Enter your domain name
Verify the SPF record is found and properly formatted
Check that the lookup count is under 10
Send a test email to mail-tester.com and check the SPF result

💡 Tip

If SPF fails at mail-tester.com but passes at MXToolbox, the issue may be with DNS propagation. Wait 24 hours and test again.

Best Practices

✓ Use the exact SPF value from your email provider
✓ Start with ~all (soft fail) for cold email
✓ Stay under 10 DNS lookups
✓ Verify at MXToolbox after adding the record
✓ Do not have more than one SPF record — consolidate into one
✓ Check SPF monthly to ensure nothing has changed

Mistakes to Avoid

✗ Adding multiple SPF records (only one is allowed)
✗ Exceeding the 10-lookup limit
✗ Using -all (hard fail) before monitoring
✗ Copying SPF values from blog posts instead of your provider
✗ Not waiting for DNS propagation before testing

Expert Tips

★ If you need to include many services, use an SPF flattening service to stay under 10 lookups
★ SPF alone is not enough — you also need DKIM and DMARC for full authentication
★ The Inbox Readiness Score checks your SPF configuration along with DKIM and DMARC

SPF Configuration Checklist

☐ TXT record added at root domain (@)
☐ Record value matches your email provider's specification
☐ ~all policy set (soft fail)
☐ DNS propagation waited (24–48 hours)
☐ Record verified at MXToolbox
☐ Lookup count under 10
☐ Test email passes SPF at mail-tester.com

Summary

SPF is a TXT record that authorizes specific servers to send email for your domain. It is configured at the root of your domain with the value provided by your email provider.

The most common errors are multiple SPF records, exceeding the 10-lookup limit, and using the wrong record value. Always use your provider's exact value and verify at MXToolbox.

SPF is one part of a three-part authentication system. For complete protection, also configure DKIM and DMARC. See our guides for each.

Frequently Asked Questions

Can I have multiple SPF records?

No. Only one SPF record is allowed per domain. If you need to authorize multiple services, combine all includes into a single record: v=spf1 include:_spf.google.com include:tool.com ~all.

What happens if I exceed 10 lookups?

SPF returns a PermError, which receiving servers treat as a failure. Use an SPF flattening tool or reduce the number of includes in your record.

Should I use -all or ~all?

Use ~all (soft fail) for cold email. It marks unauthorized email as suspicious without rejecting it outright. Use -all only after extensive monitoring confirms your record is correct.

How long does DNS propagation take?

Usually 24–48 hours, but often faster. Check with MXToolbox — if the record does not appear, verify it was saved correctly in your DNS panel.