← All articles

SPF — Sender Policy Framework

SPF is a DNS TXT record at the root of your domain that lists which mail servers are allowed to send as you. If you send from Gmail, Google's servers. If you use Resend, their servers. Without SPF, receiving mail systems (Gmail, Outlook, corporate mail gateways) treat your email as suspicious and drop it to spam — or reject it outright.

What you'll add

Exactly one TXT record:

Host:  @
Type:  TXT
Value: v=spf1 include:_spf.google.com ~all

Swap _spf.google.com for your actual sending provider's include (below).

Common provider includes

If you send from more than one provider

Combine the includes in a single SPF record — you cannot have two SPF records on the same domain (that's an SPF PermError):

v=spf1 include:_spf.google.com include:amazonses.com ~all

Keep your total DNS lookups under 10. Each include: counts as at least one lookup, and some includes nest. If you exceed 10, receivers will hard-fail your record.

The `all` mechanism

• ~all (soft-fail) — recommended for cold outreach. Receivers treat unlisted senders as suspicious but still deliver. Gives you a safety margin while you iterate on infrastructure.
• -all (hard-fail) — strict. Only matching senders accepted. Use once your sending is stable.
• ?all / +all — never use these. +allessentially disables SPF.

Where to add the record

Every DNS provider is slightly different, but the shape is the same:

• Cloudflare → DNS → Records → Add record
• Namecheap → Advanced DNS → Add new record
• GoDaddy → DNS → Manage Zones
• Route 53 → Hosted Zones → Create Record

Verify

DNS changes can take up to 24 hours to propagate but usually finish in 5–15 minutes. Once it's live, head to Settings → Domain health and hit Check. You can also spot-check from a terminal: dig txt yourdomain.com or nslookup -type=txt yourdomain.com.

Next

SPF alone is not enough. Pair it with DMARC (policy) and DKIM (signing). The full walkthrough lives at Sending domain setup.