StopBouncingWhy SPF and DKIM Matter
Gmail and Yahoo announced in 2024 that bulk senders — anyone sending 5,000+ emails per day to their platforms — must have SPF, DKIM, and DMARC configured or their emails will be rejected outright. But even for lower-volume senders, missing authentication records significantly increase spam folder placement rates across all major inbox providers.
Without SPF, any server on the internet can send email that appears to come from your domain. Spammers and phishers exploit this to impersonate legitimate businesses. SPF tells receiving servers which servers you have authorised — anything else should be treated with suspicion.
Without DKIM, receiving servers can't verify that messages haven't been modified in transit. DKIM also survives email forwarding better than SPF because the signature travels with the message, not the IP address. Together, SPF and DKIM form the foundation of email authentication — DMARC then enforces what happens when they fail.
SPF Mechanism Reference
Every element in an SPF record has a specific purpose. Here is a complete reference for all SPF mechanisms, modifiers, and qualifiers.
| Mechanism | What it does |
|---|---|
| v=spf1 | Required first element. Declares this as an SPF record. Every SPF record must start with this. |
| include: | Imports the SPF policy of another domain. Used to authorize third-party sending services. Each include costs 1 of your 10 DNS lookup allowance. |
| a | Authorizes the IP address(es) in your domain's A record to send email. Useful if your web server also sends mail. |
| mx | Authorizes all mail servers listed in your domain's MX records to send email. Common for domains whose inbound and outbound servers are the same. |
| ip4: | Explicitly authorizes a single IPv4 address or CIDR range (ip4:203.0.113.0/24). Use for dedicated sending servers with a known static IP. |
| ip6: | Explicitly authorizes an IPv6 address or CIDR range. Same as ip4 but for IPv6 addresses. |
| exists: | Authorizes a sender if a DNS A record exists for the specified domain. Rarely used in practice. |
| redirect= | Replaces the entire SPF policy with the one at the specified domain. Use when consolidating SPF across multiple domains. Cannot be combined with -all. |
| -all | Hardfail: mail from any server not listed in the record should be rejected. The strongest setting — use after verifying all legitimate sources are included. |
| ~all | Softfail: mail from unlisted servers is tagged as suspicious but usually still delivered. Use while you're still identifying all sending sources. |
| ?all | Neutral: no policy for unlisted servers. Equivalent to no SPF at all. Not recommended for production. |
| +all | Passfail: all servers are authorized. Provides no protection whatsoever. Never use this — it makes SPF completely ineffective. |
DNS lookup limit
SPF records are limited to 10 DNS lookups total (include:, a, mx, exists:, and redirect= each count as one lookup). Exceeding 10 causes a "permerror" — most receivers treat this as an SPF fail. ip4: and ip6: do not cost a lookup.
SPF Include Strings by Email Provider
Add the correct include: statement to your SPF record for each service that sends email from your domain.
| Email provider | Add to your SPF record |
|---|---|
| Google Workspace (Gmail) | include:_spf.google.com |
| Microsoft 365 / Exchange Online | include:spf.protection.outlook.com |
| SendGrid | include:sendgrid.net |
| Mailchimp / Mandrill | include:servers.mcsv.net |
| HubSpot | include:hubspotemail.net |
| Klaviyo | include:klaviyomail.com |
| Postmark | include:spf.mtasv.net |
| Mailgun | include:mailgun.org |
| Amazon SES | include:amazonses.com |
| Resend | include:spf.resend.com |
| Zoho Mail | include:zoho.com |
| Brevo (Sendinblue) | include:spf.sendinblue.com |
| ActiveCampaign | include:emsend.net |
| Constant Contact | include:spf.constantcontact.com |
| Salesforce Marketing Cloud | include:exacttarget.com |
| FastMail | include:spf.fastmail.com |
| Proton Mail | include:_spf.protonmail.ch |
Provider SPF includes may change. Always verify the current include string in your email provider's official documentation before publishing.
Common SPF Errors and How to Fix Them
Too many DNS lookups
Cause: SPF records are limited to 10 DNS lookups total. include:, a, mx, exists:, and redirect= each cost one lookup. Exceeding 10 causes a 'permerror' which many receivers treat as a fail.
Fix: Audit your SPF record and remove unused include: entries. Flatten repeated lookups by replacing include: statements with direct ip4: entries for static IPs. Some providers offer SPF flattening services.
Multiple SPF records
Cause: A domain must have exactly one SPF TXT record. If you have two TXT records starting with v=spf1, the receiving server may reject both with a permerror.
Fix: Merge all your SPF content into a single TXT record. Delete any duplicate v=spf1 records in your DNS settings.
Using +all (pass all)
Cause: The +all qualifier authorizes every server on the internet to send mail from your domain. This makes SPF completely meaningless.
Fix: Replace +all with -all (hardfail) or ~all (softfail). Use ~all while you're still confirming all your legitimate sending sources, then switch to -all.
SPF record too long
Cause: A single DNS TXT record has a 255-character limit per string, but can span multiple strings. Some DNS editors don't handle this correctly and truncate the record.
Fix: Break the record into multiple quoted strings if needed, or reduce the length by flattening include: entries into ip4: ranges.
Missing sending service
Cause: You added a new transactional email provider (e.g. Resend, Postmark) but forgot to add its include: to your SPF record. Emails from that provider will fail SPF.
Fix: Check the documentation of every email service you send from and add each one's include: entry to your SPF record.
SPF pass but email still in spam
Cause: SPF checks the envelope-from domain, not the visible From header. DMARC requires alignment between the two — SPF alone passing doesn't guarantee inbox placement.
Fix: Set up DKIM so the From domain is signed, and configure DMARC to enforce alignment. Check your DMARC policy with the free DMARC checker.
How to Set Up SPF: Step-by-Step
List all your email sending sources
Collect every service that sends email on behalf of your domain: your mail server (Google Workspace, Office 365), transactional providers (SendGrid, Postmark, Mailgun), marketing platforms (Mailchimp, Klaviyo), and any custom SMTP servers. A missing include is the most common SPF problem.
Build your SPF record
Start with "v=spf1", then add include: entries for each provider from the table above. For any static IP addresses (dedicated servers), add ip4: entries. End with "~all" for now. Example: v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.5 ~all
Publish the TXT record in DNS
Add a TXT record to your domain's DNS with the host set to "@" (your root domain) and the value set to your SPF record string. If you use Cloudflare, your DNS provider, or a registrar control panel, the TXT record type is the correct one — do not use SPF record type (deprecated).
Verify with this tool
Enter your domain in the SPF & DKIM checker above. Confirm the record is found, the mechanism count is under 10, and the policy ends with a qualifier (-all or ~all). Fix any errors before moving to the next step.
Test email delivery
Send a test email from each of your sending sources to a test inbox. Use Google's MessageHeader analyzer or Mail-tester.com to check SPF alignment in the email headers. Confirm each sender passes SPF.
Switch to -all
Once you've confirmed all legitimate sources pass SPF, change "~all" to "-all" in your DNS record. This upgrades from softfail (suspicious but delivered) to hardfail (reject). Wait for DNS propagation (up to 48 hours) and re-verify.
SPF & DKIM FAQ
What is an SPF record?
An SPF (Sender Policy Framework) record is a DNS TXT record that lists which mail servers are authorized to send email from your domain. When a receiving server gets an email claiming to be from your domain, it checks the SPF record to verify the sending server is authorized. Missing or incorrect SPF records increase the chance of your email landing in spam or being rejected.
What is DKIM?
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your outgoing email messages. The receiving server uses your DKIM public key (published in DNS) to verify that the message came from your domain and wasn't altered in transit. DKIM is required by Gmail and Yahoo for bulk senders since 2024.
What is the difference between SPF softfail (~all) and hardfail (-all)?
With ~all (softfail), email from unauthorized servers is tagged as suspicious but usually still delivered. With -all (hardfail), email from unauthorized servers should be rejected outright. Start with softfail while you confirm all your sending sources are in the record, then switch to hardfail for maximum protection.
Why does DKIM not show for my domain?
DKIM keys are published at a specific selector subdomain (e.g., google._domainkey.yourdomain.com). This tool checks common selectors (google, default, mail). If your email provider uses a different selector, check your provider's DKIM configuration documentation to find the correct selector name and enter it in the tool.
Can I have multiple SPF records?
No. A domain must have exactly one SPF TXT record. If you have multiple records starting with v=spf1, receiving servers may reject both with a 'permerror' — which is treated as an SPF fail. Merge all your authorized senders into a single SPF record.
What happens when an email fails SPF?
What happens depends on the receiving server's policy and your DMARC configuration. Without DMARC, SPF failure often results in spam folder placement rather than rejection. With DMARC p=quarantine or p=reject, SPF failures combined with DKIM failures will result in the email being quarantined or rejected. The SPF result alone doesn't determine the final outcome — DMARC is the enforcement layer.