How to fix your SPF record

What SPF is

SPF is a TXT record on your domain that starts with v=spf1. When a mail system receives a message from your domain, it checks that list to see whether the sending server is one you approved. It is one of the three checks, along with DKIM and DMARC, that keep your mail out of spam and make it harder for someone to fake your address.

Rule one: only one SPF record

This is the mistake I see most. Someone sets up Microsoft 365, then a newsletter tool, and each one says "add this SPF record", so the domain ends up with two TXT records that start with v=spf1. The standard says that is an error, and many mail systems then treat your SPF as broken.

The fix: combine everything into a single record. Open your DNS settings, find every TXT record that starts with v=spf1, merge their parts into one, and delete the extras.

The right include for your email provider

Your record should name the service that hosts your mailboxes. Use the one that matches yours. Add any other sending services (newsletters, booking or invoicing tools) only if their own help pages tell you to.

Microsoft 365

v=spf1 include:spf.protection.outlook.com ~all

This also applies if you bought Microsoft 365 through GoDaddy. GoDaddy usually sets this record up for you when the DNS is at GoDaddy, so check what is there before adding anything.

Google Workspace

v=spf1 include:_spf.google.com ~all

GoDaddy email (Professional Email and older GoDaddy mail)

v=spf1 include:secureserver.net ~all

If you moved from GoDaddy email to Microsoft 365 or Google, remove include:secureserver.net unless something still sends through GoDaddy. Old includes left behind are common and quietly eat into the lookup limit below.

~all or -all?

The ending tells mail systems what to do with senders that are not on your list. ~all ("soft fail") says treat them as suspicious. -all ("fail") says they are not authorized at all.

My advice: start with ~all. Once you have DMARC set to quarantine or reject, DMARC is what actually decides what happens to fake mail, and ~all is a perfectly good ending. Move to -all only when you are sure every real sender is on the list. Never use +all. It approves the entire internet to send as you.

The 10-lookup limit

SPF allows at most 10 DNS lookups when a mail system checks your record. Each include:, a, mx, exists and redirect counts, and so do the includes inside those includes. Microsoft 365 or Google alone use only a few, but stack five or six marketing and billing tools and you can go over. When that happens, SPF fails for every message, not just the extra ones.

How to stay under it:

• Remove includes for services you no longer use.
• Drop a and mx unless your website or mail server really sends mail directly.
• Check whether a tool sends from its own domain. Many newsletter and invoicing services do, and only need DKIM set up on your domain, not an SPF include.

The checkup counts your lookups and tells you if you are over.

Do not add your web server's shared IP

If your website's contact form sends mail and someone tells you to add your hosting server's IP address to SPF, be careful. On shared hosting, that IP address is shared with many other websites. Adding it means every one of them is now approved to send mail as your business.

The better fix is to have the website send through your real email account. On WordPress, an SMTP plugin connected to your Microsoft 365 or Google mailbox does this, and the mail passes SPF and DKIM the normal way.

Where to make the change

Edit the TXT record in your DNS settings, wherever your nameservers point (GoDaddy, Cloudflare, Squarespace or another host). The name or host is @ (meaning the domain itself) on most hosts. The steps for adding a TXT record are the same as in the DMARC guide, just with @ as the name.