Setting Up an SPF Record - Step-by-Step Guide

Are your sales emails not reaching the inbox?

You might be missing an SPF record.

SPF is an email authentication protocol that makes emails more secure, leading to better inbox placement.

The best part? Setting up an SPF record is easy.

We’ll show you how to do it so you have a better chance of avoiding the spam folder.

What SPF Is

Sender Policy Framework is an email security protocol. It was designed to make it harder for cybercriminals to launch phishing attacks and other email-based fraud.

The way SPF combats these internet scumbags is by allowing you to decide what email servers can send emails on your domain’s behalf.

That way, any incoming email claiming to come from your domain has to have been sent by an authorized server. If not, it will fail authentication.

Ok, but how do I authorize sending servers to send from my domain?

You can determine what servers can send on behalf of your domain by implementing an SPF record. This is what it looks like:

v=spf1 include:_spf.google.com ~all

Let’s explain what it all means:

The v=spf1 thingy indicates the SPF version. It’s always spf1, so nothing complicated here.

Do pay close attention to the include tag. That’s where the server’s domain goes.

For some servers, you use IP numbers. If that’s the case, the include tag gets replaced by an ip4 or ip6 tag, depending on the type of IP number. If you set up the record above, it means you’ll allow Google to send from your domain.

Finally, we have the all tag. It defines your policy toward emails that fail authentication. The most frequently used all tag policy settings are:

• ~all = Soft fail: Emails that fail authentication are accepted but marked as suspicious. These emails may get sent to spam.

• -all = Hard fail: Emails that fail authentication are rejected outright- These emails may not get delivered at all.

Why You Must Set Up an SPF Record

For any kind of email outreach, setting up SPF is no longer optional.

If you want to land in your prospect’s inbox, you must set up SPF.

A correctly working SPF record makes your emails more secure. Email providers will recognize you as a more trusted sender and reward you with better inbox placement.

How to Set Up an SPF Record in 4 Simple Steps

While setting up an SPF record can seem complicated, the truth is it’s rather simple. Especially if you have the right instructions. We’re giving you these step-by-step instructions today.

Let’s start with the high-level steps, so you have a good overview of the process.

1. ➡️ Find out what SPF record you have to set up

2. ➡️ Check if your domain has an existing SPF record set up

3. ➡️ Add the SPF record to your domain provider or modify the existing one

4. ➡️ Validate the SPF record

1. Find out what SPF record you have to set up

The main question here is: Whose email infrastructure are you using to send your emails?

You must add their SPF record to your domain’s DNS records.

Consider these three scenarios:

1. You’re using a sales outreach tool, but connect your email provider’s account to it. → You need to add your email provider’s SPF record because their servers are doing the actual sending. This could be Google Workspace, Office 365, etc.

2. You’re using an outreach tool without an email provider connected to your account. In other words, you’re using the outreach tool’s email infrastructure to send emails. → You must add the outreach tool’s SPF record to your domain’s DNS records.

3. You’re using your hosting company’s email servers to send emails. You’re directly using the email accounts associated with your domain and hosting company. → You must add your hosting company’s SPF record (with their email servers in it).

How do you set up SPF for specific email providers?

We have step-by-step guides on:

• Setting up an SPF record for Google Workspace

• How to set up an SPF record for Zoho Mail

• How to configure an SPF record for Office 365

2. Check if your domain has an existing SPF record set up

If you’re wondering if your domain can have multiple SPF records, the answer is no.

Having more than one SPF record can lead to complications during the authentication process.

So, can I not authorize multiple sending servers from my domain?

Yes, you can!

How?

By adding multiple sending servers to the same record.

We’ll show you how to do that in a minute, but it won't even be necessary if you don’t have an existing SPF record set up.

So, let’s check for an existing SPF record first.

The exact steps will differ depending on your domain provider, but the steps below should offer good guidance:

1. ➡️ Log in to your domain provider account and select your domain

2. ➡️ Look for a page or tab called DNS, DNS management, Advanced DNS, or similar

3. ➡️ Now look for a TXT record that includes the SPF version tag: v=spf1

For exact steps on how to set up an SPF record or modify an existing record, we have tutorials for specific domain providers, too:

• How to set up an SPF record on GoDaddy

• How to add an SPF record to OVHCloud

• Setting up an SPF record on Cloudflare

• Configuring an SPF record in Namecheap

3. Add the SPF record to your domain provider or modify the existing one

1. ➡️ Found an existing SPF record in the previous step? Take any include or ip4/ip6 tags from the record you have set up and add them to your existing SPF record.* Click save when done. Here’s an example of an SPF record with multiple include and ip tags (sending servers): v=spf1 ip4:192.168.0.1 ip6:2001:db8::1 include:_spf.google.com include:anothersendingserver.net -all

2. ➡️ No existing record? Add a new record.

3. ➡️ Choose TXT as the record’s Type

4. ➡️ Put @ in the Host or Name field - unless you’re setting up an SPF record for a subdomain, in which case you should enter the subdomain itself (e.g., mail.example.com)

5. ➡️ Paste your email provider’s SPF record into the Value or Target field. For example: v=spf1 include:spf.protection.outlook.com -all

6. ➡️ Leave the TTL to the default or a value between 1800 and 3600. TTL means Time To Live and it’s the time in seconds a server caches your SPF record.

7. ➡️ Save your record!

*SPF has a DNS lookup limit of 10. Make sure to remove redundant sending servers from your SPF record.

4. Validate your SPF record

The final step is validating your SPF record.

You see, it can take up to 72 hours for your SPF record to propagate fully.

Fortunately, we have never seen it take that long. Usually, your record becomes active in a couple of hours.

You can use MXToolBox’s SuperTool to check the status of your SPF record.

Click the dropdown menu of the orange button and select SPF Record Lookup (1).

Then enter your domain (2) and hit the orange button.

The results will tell you if your SPF record has been configured correctly.

SPF record not working?

1. Ensure your SPF record’s syntax is correct. A missing character or an extra space can render your SPF record useless.

2. Double-check for multiple SPF records. You can only have a single SPF record for your domain. If you need to authorize multiple sending servers, do so in the same SPF record.

3. Ensure you have the correct SPF record and the correct include, ip4, or ip6 tags. Some email providers’ SPF records floating around the internet may be outdated. Get the required information from official channels only.

4. Give it some time. As mentioned, your record can take a few days to propagate fully.

Email Authentication Beyond SPF

SPF isn’t the only email authentication method around.

To ensure your emails reach the inbox, and not the spam folder, you also need to set up DKIM and DMARC alongside SPF.

DKIM ensures criminals can’t change emails after they are sent, and DMARC lets you decide what should happen to emails that fail authentication.

You need to set up all three!