Where do I publish an SPF record?

As a TXT record at the root of your domain, in your DNS provider's settings. The host is usually shown as @ or left blank.

Can I have more than one SPF record?

No. Publish one record per domain and merge all your senders into it.

Does my subdomain need its own SPF record?

Yes, if it sends mail. SPF is not inherited by subdomains.

Should I use -all or ~all?

Start with ~all while you check your senders, then move to -all if you want stricter handling.

Why does SPF pass but DMARC fail?

SPF may pass for the sending service's own domain, which does not match your From domain. DMARC needs SPF or DKIM to pass for your domain.

How to Set Up an SPF Record for Your Domain

Step-by-step

List every service that sends email with your domain: your mailbox provider, newsletter and marketing tools, invoicing and support systems, and any servers you run yourself.
Open the SPF Generator. Use the quick-add buttons or the Include list for each service, and add fixed server addresses under IPv4 and IPv6.
Choose a failure policy. Start with soft fail (~all) and move to fail (-all) once you are sure every sender is listed.
Copy the record and publish it as one TXT record at the root of your domain. If a record already exists, edit it instead of adding a second.
Check it with the SPF Validator, which follows the includes and counts the DNS lookups.
Send test messages from each service and check the headers for spf=pass.

What SPF actually checks

SPF checks the server against the domain in the message's envelope sender (the Return-Path), not the From address people see. Many sending services use their own bounce domain, so SPF can pass for the service without matching your domain. DMARC looks for a pass that aligns with your From domain, which is why DKIM matters as well.

One record, and one per sending domain

A domain must publish exactly one SPF record. Two records cause a permanent error. SPF is not inherited, so each subdomain that sends mail needs its own record. A subdomain that never sends mail can publish v=spf1 -all to state that nothing is allowed.

Failure policies

-all asks receivers to fail mail from unlisted servers. ~all marks it as a soft fail, which is gentler and a good place to start. ?all makes no statement, and +all allows everyone, so avoid both. Whatever you choose, SPF alone does not stop someone forging your visible From address. Use it with DKIM and DMARC.

The 10 lookup limit

Each include, a, mx, exists and redirect term costs a DNS lookup, and the lookups inside included records count too. Going over 10 produces a permanent error. If you are near the limit, the guide on fixing too many SPF lookups explains how to reduce them.

USE THE TOOL

Finish the task with DevUtilityKits

Use the relevant online utility, check the result, and continue with your development workflow.

Open SPF Generator →Open SPF Validator →Open DNS Lookup →