When a message arrives, the receiving server looks up the SPF record of the domain in the envelope sender (the Return-Path address, not the From line people see) and checks whether the sending server's IP address is on the list. The result is pass, fail, softfail or neutral, and it feeds into spam filtering and into DMARC.
v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all
The rules that trip people up
- One record per domain. Two TXT records that both start with v=spf1 make SPF fail; merge them into one.
- At most 10 DNS lookups. Every include, a, mx and redirect counts, including the ones nested inside an include. Past 10, SPF returns a permanent error.
- End with an all rule. ~all (softfail) is the usual choice while you set things up; -all (fail) is stricter once you know every sender is listed.
SPF and cold email
Since February 2024, Gmail and Yahoo ask every sender to authenticate with SPF or DKIM, and bulk senders to use both plus DMARC. For cold email, set SPF up on each sending domain before you warm a mailbox. Because SPF checks the envelope domain, it only helps DMARC when that domain matches your From domain, which is why you also want DKIM and DMARC.
Build a record with the SPF record generator, which counts lookups as you add services, then confirm it is live with the domain email checker. In ZicReach, domain checks mark SPF as Pass, Warning or Missing for every sending domain and flag duplicate records, with the exact value to add.