How do I create an SPF record for a custom domain?

What does an SPF record contain?

An SPF record is a TXT record that starts with v=spf1 and continues with mechanisms, each with an optional qualifier. RFC 7208 defines the mechanisms all, include, a, mx, ip4, ip6, exists and ptr, and the modifier redirect. The qualifier decides the result when a mechanism matches: + pass (the default), - fail, ~ softfail and ? neutral.

For a domain that uses an email provider, one mechanism does nearly all the work: include. It tells the receiver to evaluate the SPF record of the provider's domain and to treat a match there as a match for yours. You never copy IP addresses by hand, so the provider can change its servers without touching your DNS. If you send from a server of your own, ip4 and ip6 list its addresses and cost no lookup.

SPF is published as a TXT record. A single TXT string is limited to 255 octets, and a longer record is split into several strings that the receiver joins without a space. Most DNS editors do the splitting for you.

Why can a domain have only one SPF record?

If two TXT records both start with v=spf1, the receiver cannot choose and returns a permanent error, so every message fails SPF. RFC 7208 states that a domain must not have more than one SPF record. Proton, Mailbox.org and Mailfence all give the same advice: when you add a service, put its include into the record that exists.

The usual cause is a move. You publish the new provider's record and forget the old one. Open the TXT list, merge the two lines into one, and delete the leftover. When you change provider for good, replace the old include instead of adding to it. The move itself is described in how to move email to a new provider without losing mail.

What is the 10-lookup limit in SPF?

SPF evaluation stops with a permanent error after 10 DNS-querying terms, so a record that needs 11 fails for every sender. The terms that count are include, a, mx, ptr, exists and the redirect modifier. The mechanisms all, ip4 and ip6 do not count. RFC 7208 also says implementations should stop after two void lookups, which return nothing or a non-existent domain.

An include counts as one lookup plus every lookup inside the included record. One mailbox provider is therefore cheap, but a stack of a mail host, a newsletter service, a help desk and a website form adds up. Remove the services you no longer use first. When a tool publishes fixed IP addresses, ip4 and ip6 ranges cost nothing. The exact nested count of each provider was not measured by Postelva, so test your final record with a lookup before you rely on it, as shown in how to check MX, SPF, DKIM and DMARC records.

Should I end my SPF record with ~all or -all?

Use ~all unless you control every sender: it marks other servers as suspicious without asking receivers to refuse the mail outright. The qualifier on all is the verdict for any server that matched nothing earlier. -all means fail, ~all means softfail, ?all means neutral.

A hard -all is stricter, but RFC 9989 warns that it can cause a receiver to reject a message before DMARC even runs, which hides a forwarded message that DKIM would have saved. For that reason the record Proton and Mailbox.org show ends in ~all. According to Postelva's comparison of 12 November 2026, the three providers with a full SPF value on their help pages (Proton Mail, Mailbox.org, Fastmail) each use exactly 1 include, so a single-provider record costs 1 lookup, and two of them end in ~all while Fastmail's value ends in ?all.

Whatever the ending, DMARC does the enforcing. Set the policy there, as explained in the guide to setting up DMARC. The three records are compared in SPF vs DKIM vs DMARC.

What does SPF check, and what does it not?

SPF checks the server behind the envelope sender and the HELO name, not the From address in the message that the reader sees. A message can pass SPF for a domain nobody notices and still show your domain in the From line. DMARC closes that gap by requiring alignment between the two.

SPF also does not survive plain forwarding, because a forwarder delivers from its own IP address. A citable rule of thumb: SPF authorizes servers, one record per domain, 10 lookups at most. For a domain that sends nothing, publish v=spf1 -all and the Postelva "no email" template; for a domain that sends and receives, one-click DNS templates for Proton Mail, Fastmail, Zoho Mail, Google Workspace and Microsoft 365, plus an SPF + DMARC template and a "no email" template for a domain that sends nothing.