Common SPF mistakes
- Two SPF records. Adding a new service as a second
v=spf1record instead of merging it. Receivers then fail SPF for everything. - Too many lookups. Google, Microsoft 365, a newsletter tool and a CRM can pass 10 lookups together. Remove services you no longer use.
- Ending in +all. This authorizes the whole internet. Use
~allor-all. - Forgetting a sender. Invoicing tools, website contact forms and helpdesks often send as your domain too.
Example record: v=spf1 include:_spf.google.com include:sendgrid.net ~all
Frequently asked questions
~all or -all?
With a DMARC policy in place, ~all (soft fail) is the common choice, because DMARC makes the final decision and forwarding breaks less. -all is fine once you are certain every sender is listed.
How do I reduce SPF lookups?
Remove includes for services you stopped using, replace a and mx with ip4: and ip6: ranges where they rarely change, and send marketing mail from a subdomain with its own SPF record.
More from Email Security Check
- Can someone send email as your domain?
- DKIM record checker
- DMARC record generator
- MTA-STS and TLS-RPT checker