How to configure SPF

Quick answer: SPF (Sender Policy Framework) is a DNS TXT record on your domain that lists which servers may send mail for it. A typical record for a single VPS is v=spf1 ip4:YOUR.SERVER.IP -all. Publish exactly one SPF record; receiving servers check it on every message.

Overview

When a mail server receives a message claiming to be from yourdomain.com, it looks up that domain's SPF record and checks whether the connecting IP is authorised. Without SPF (or with a broken record) your mail is far more likely to be rejected or filed as spam. SPF is one of the three authentication pillars, together with DKIM and DMARC.

Before you start

• Access to your domain's DNS zone (at your registrar or DNS provider).
• The list of everything that legitimately sends mail for the domain: your VPS IP, a mailbox provider, newsletter or relay services.

Step-by-step guide

1. Inventory your senders — every service that puts your domain in the From address.
2. Create a TXT record on the domain root. Examples:

   # VPS only
   v=spf1 ip4:203.0.113.10 -all
   
   # VPS + Google Workspace
   v=spf1 ip4:203.0.113.10 include:_spf.google.com -all

3. Choose the final qualifier: -all (fail everything else — strict, recommended once the list is complete) or ~all (softfail — useful during rollout).
4. Verify from any machine:

   dig +short TXT yourdomain.com

5. Send a test to a large provider and confirm spf=pass in the Authentication-Results header.

Common issues

• Two SPF records: multiple v=spf1 TXT records make SPF permanently fail — merge them into one.
• Too many DNS lookups: SPF allows at most 10 include/lookup mechanisms; flatten rarely-used includes.
• Forgetting a sender: mail from a forgotten service (a CRM, a form plugin) starts failing after you set -all — recheck the inventory.

When to contact support

SPF lives in your domain's DNS, not on the server, so most fixes happen at your DNS provider. Ask us via ticket when you need to confirm the correct IP addresses of your Cloud2Y services to include.

Frequently asked questions

How many SPF records can a domain have?

Exactly one TXT record starting with v=spf1. Publishing two or more makes SPF checks fail permanently, so merge all senders into a single record instead of adding new ones.

Should I use -all or ~all at the end of SPF?

Start with ~all (softfail) while you confirm every legitimate sender is listed, then switch to the strict -all so that unauthorised servers are rejected outright.

How do I verify my SPF record is live?

Run dig +short TXT yourdomain.com from any machine and check the returned v=spf1 string, then send a test mail and look for spf=pass in the Authentication-Results header.

Related articles

• How to configure DKIM
• How to configure DMARC
• How to avoid email going to spam
• How to configure SPF, DKIM and DMARC (DNS overview)

Need a hand? Contact Cloud2Y support →