← All articles

Creating an SPF record: step by step

How to create your domain's SPF record correctly: collect services, build the record, set it in DNS, verify. With examples for Microsoft 365 and Google.

6 min read · Updated 2 September 2026

SPF (Sender Policy Framework) is a list of the servers allowed to send email on behalf of your domain. It is published as a TXT record in your domain's DNS, and receiving mail servers look it up for every incoming email. If the record is missing or wrong, your mail ends up in spam more easily — and strangers can more easily write in your name.

Step 1: Collect all sending services

The most common SPF mistake is not a typo but a forgotten service. Collect EVERYTHING that sends in your name: the mail provider itself, the newsletter tool, the shop, the invoicing software, the CRM, the website's contact form, monitoring systems. Every service that is missing will run into delivery problems later.

• Mail provider (Microsoft 365, Google Workspace, Proton, World4You …)
• Newsletters (Mailchimp, Brevo, CleverReach …)
• Shop and accounting (Shopify, sevdesk …)
• Website forms (often the web host does the sending)

Step 2: Build the record

An SPF record always starts with v=spf1, followed by the permitted senders (usually as an include for each service), and ends with the rule for everyone else. For Microsoft 365 it looks like this:

Several services go into the SAME record, never into a second one: two SPF records on one domain are a permanent error according to the standard, and many receivers then stop evaluating the check altogether.

~all or -all?

The end of the record says what should happen to senders that are not listed: ~all (softfail) means "probably not genuine, but be lenient", -all (fail) means "reject". To begin with, as long as you are not sure you have captured every service, ~all is the safe start. The goal is -all — but only after a few weeks have passed without any legitimate mail turning up from an unexpected source.

Step 3: Set it in DNS and verify

The record goes onto the domain itself as a TXT record (in most DNS interfaces the field is called "Name" or "Host" and stays empty or contains an @). After saving, it takes a few minutes to hours, depending on the TTL, until all servers see the new state. Afterwards, do not check by hand but with a tool — it also sees the errors that are invisible in the editor: duplicate records, broken includes, the lookup limit.