How to set up an SPF record
SPF (Sender Policy Framework) is a DNS TXT record that authorises specific senders to send mail for your domain. Without one, modern receivers (Google, Microsoft, Yahoo) treat your sending as suspect and drop deliverability sharply.
Setup takes 5-10 minutes if you know your sending providers. The most common failure mode is the 10-DNS-lookup limit, which silently breaks SPF without warning. This guide covers the syntax, the lookup-limit math, and verification.
Before you start
- Domain you control (must have DNS edit access)
- List of all services that send mail on your behalf (Google Workspace, Microsoft 365, Mailgun, SendGrid, your cold-outbound tool, etc.)
Step-by-step
- 1
List every sender that uses your domain
Enumerate every email-sending service: your mailbox provider (Google Workspace / Microsoft 365), any marketing platform (Mailchimp, Klaviyo, HubSpot), transactional senders (Postmark, SendGrid, Mailgun), cold-outbound tools (Saleshandy, Outreach.io). Each needs to be included in SPF.
- 2
Look up each provider's recommended SPF include
Most providers publish their SPF include. Google Workspace: include:_spf.google.com. Microsoft 365: include:spf.protection.outlook.com. Mailgun: include:mailgun.org. Check each provider's documentation.
- 3
Compose the SPF record
Single TXT record starting with v=spf1, followed by mechanisms separated by spaces, ending with a qualifier. Example: v=spf1 include:_spf.google.com include:spf.protection.outlook.com include:mailgun.org -all
- 4
Check the 10-lookup limit
SPF must resolve in 10 DNS lookups or fewer. Each include: counts as one. Use a tool like MxToolbox SPF Lookup to count. If above 10, consolidate or flatten (replace includes with the underlying mechanisms; some tools automate this).
- 5
Publish the TXT record on your DNS provider
In your DNS dashboard (Cloudflare, Route 53, Google Domains, etc.), create a TXT record at the root of your domain with the SPF string as the value. TTL of 3600 (1 hour) is fine; lower if you expect frequent edits.
- 6
Verify SPF resolves correctly
After 5-15 minutes for DNS propagation, run dig TXT yourdomain.com or use MxToolbox SPF Check. The result should be 'SPF Record Published' with no errors.
- 7
Send a test email and check headers
Send to a mailbox you control. Open raw headers (Show Original in Gmail). Look for Authentication-Results: spf=pass. If pass, SPF is working. If fail, check the IP that sent the message against your SPF mechanisms.
Set up tracking in 2 minutes instead of 20.
Outsolvi installs as a native Outlook add-in or Gmail Chrome extension. Confidence-scored opens, AI follow-up alerts, native Outlook and Gmail tracking. From $7/mo, 14-day free trial.
Troubleshooting
MxToolbox shows 'SPF PermError - Too many DNS lookups'
Above 10 includes. Two options: drop a sender you don't actually use, or use a SPF flattening service (DMARCLY, EasyDMARC) that resolves all your includes into static IP lists at publish time.
Some emails still fail SPF after publishing
Check which sender produced the failing message. Either the sender isn't in your SPF, or the From domain doesn't match the SPF domain. Add the sender or fix the From.
Multiple SPF records on the same domain
Only one SPF record is allowed per RFC 7208. Multiple records cause PermError. Merge into one TXT record.
Frequently asked
What's the difference between -all and ~all?
-all is hard fail: receivers should reject mail from unauthorised IPs. ~all is soft fail: receivers should mark as suspect but accept. -all is the recommended posture for production senders.
Will SPF alone protect my domain from spoofing?
No. SPF authorises sending IPs but doesn't tie them to the visible From address. You need DMARC (and ideally DKIM) for spoofing protection.
Does Outsolvi require SPF changes?
No. Outsolvi tracks engagement on outbound mail you send via your existing provider. It doesn't send mail and doesn't need SPF authorisation.
More on email tracking
Glossary terms, comparisons, and feature deep-dives related to this guide.
Nate built Outsolvi after watching every email-tracking tool he had ever used lie to him about opens. Outsolvi runs Tier 1 to 5 confidence scoring on every open, native in Outlook and Gmail, so the number on the dashboard is one a rep can actually act on.
We update these pages when the underlying mechanics change. new mailbox-provider rules, new tracker behavior, new measurement gaps. The dates above are real revisions, not auto-touches.