Blog
SPF record examples for common email providers
Reviewed by the Free Domain Mail editorial team · Updated
SPF examples are starting points, not values to paste blindly. Authorize only services that actually send for the domain and publish exactly one SPF policy per hostname.
Single-provider examples
Google Workspace commonly uses v=spf1 include:_spf.google.com ~all. Microsoft 365 commonly uses v=spf1 include:spf.protection.outlook.com ~all. Amazon SES can use v=spf1 include:amazonses.com ~all when SPF at that hostname is part of the design.
Confirm each provider's current official DNS documentation and whether it authenticates a custom MAIL FROM subdomain instead of the visible From domain.
Combine legitimate senders
If Google Workspace and Amazon SES both send from the same hostname, combine them: v=spf1 include:_spf.google.com include:amazonses.com ~all.
Do not publish two v=spf1 records. Remove includes when a service stops sending and remain within SPF's ten DNS-lookup limit.
Stage enforcement safely
Use ~all while inventorying senders, then consider -all only after real messages from every application have been tested.
Pair SPF with DKIM and DMARC alignment. A passing SPF record alone neither prevents visible-domain spoofing nor guarantees inbox placement.
Common mistakes to avoid
- Copying every provider include just in case.
- Publishing separate SPF records for separate services.
- Counting text length but not recursive DNS lookups.
Frequently asked questions
Can I copy these examples directly?
Only after confirming the exact active senders and current provider instructions for your hostname.
How many includes are allowed?
SPF evaluation permits at most ten DNS-query-causing mechanisms across recursive evaluation, not simply ten include words.
Technical references
Primary specifications and provider documentation relevant to this guide: