What is SPF and how to write a correct record

What an SPF record looks like

An example for a company with mail in Google Workspace and an invoicing program that sends from its own server:

v=spf1 include:_spf.google.com ip4:203.0.113.10 -all

• v=spf1 starts every SPF record.
• include: adds the provider's list of servers. The right value is given by your mail provider in its documentation.
• ip4: and ip6: add single addresses or ranges.
• a and mx allow the servers from the domain's A and MX records.
• -all at the end says: servers not on the list do not pass SPF.

The "all" ending

• -all (fail): mail from servers outside the list does not pass SPF; the recipient usually rejects it or treats it as suspicious. The target setting.
• ~all (softfail): mail from outside the list is only flagged. Good while you review, when you are not sure the list is complete.
• ?all (neutral): SPF says nothing about foreign servers and does not protect.
• +all: any server in the world may send mail on behalf of the domain. This is the worst possible setting.

The most common mistakes

• Two SPF records. A domain may have only one record starting with v=spf1. With two, the recipient reports a permanent error (permerror) and SPF fails. A new provider is added to the existing record.
• More than 10 DNS lookups. The include, a, mx, ptr and exists mechanisms and the redirect modifier need DNS queries, and the specification (RFC 7208) allows at most 10 such elements in one check, including those nested in your providers' records. Three or four services can exceed the limit, and the result is then permerror. In addition, more than 2 lookups of names that do not exist can also end in an error.
• One of the senders is missing: a newsletter, a shop, a CRM, a website form. Their messages do not pass SPF.
• The ptr mechanism. It is deprecated and slow; better to remove it.

What SPF does not do

SPF checks the envelope sender address (MAIL FROM, later visible in the Return-Path header) and the server name from the HELO greeting, not the address in the "From" field that the recipient sees. That is why SPF alone will not stop spoofing. You also need DKIM (DKIM guide) and DMARC: DMARC guide.

You can check your record with the SPF checker: it shows the syntax, the all ending and the number of DNS lookups.