SPF examples are starting points, not values to paste blindly. Authorize only services that actually send for the domain and publish exactly one SPF policy per hostname. An SPF record is a TXT record that begins with v=spf1, lists mechanisms such as include, ip4 and mx, and ends with an all mechanism that says what to do with everything else. The examples below cover the most common providers and combinations.
Single-provider examples
Google Workspace commonly uses v=spf1 include:_spf.google.com ~all. Microsoft 365 commonly uses v=spf1 include:spf.protection.outlook.com ~all. Amazon SES can use v=spf1 include:amazonses.com ~all when SPF at that hostname is part of the design.
Confirm each provider's current official DNS documentation and whether it authenticates a custom MAIL FROM subdomain instead of the visible From domain. With SES, SPF is normally published on the MAIL FROM subdomain; see Amazon SES authentication.
Google Workspace v=spf1 include:_spf.google.com ~all
Microsoft 365 v=spf1 include:spf.protection.outlook.com ~all
Amazon SES v=spf1 include:amazonses.com ~all
Own server (IP) v=spf1 ip4:203.0.113.25 ~allCombine legitimate senders
If Google Workspace and Amazon SES both send from the same hostname, combine them: v=spf1 include:_spf.google.com include:amazonses.com ~all.
Do not publish two v=spf1 records. Remove includes when a service stops sending and remain within SPF's ten DNS-lookup limit.
v=spf1 include:_spf.google.com include:amazonses.com ip4:203.0.113.25 ~allCount DNS lookups, not characters
Mechanisms that need a DNS query count toward the limit of 10: include, a, mx, ptr, exists and redirect, including every one nested inside an include. ip4, ip6 and all do not count. A record that exceeds 10 returns a permanent error and SPF fails for every message.
Lookups that return nothing (void lookups) are limited to two. The SPF Checker shows the total for your published record.
A domain that sends no mail
Parked domains and receive-only domains can publish v=spf1 -all, which says no server is allowed to send for the domain. Pair it with a DMARC record of p=reject. A domain that only receives mail, for example through a catch-all inbox, does not need an include for the receiving service.
v=spf1 -allStage enforcement safely
Use ~all while inventorying senders, then consider -all only after real messages from every application have been tested. Softfail vs hardfail explains the difference.
Pair SPF with DKIM and DMARC alignment. A passing SPF record alone neither prevents visible-domain spoofing nor guarantees inbox placement. Build your record with the SPF Generator.
Common mistakes to avoid
- Copying every provider include just in case.
- Publishing separate SPF records for separate services.
- Counting text length but not recursive DNS lookups.
- Ending the record with +all, which authorises every server on the internet.
- Keeping includes for services the domain stopped using years ago.
Frequently asked questions
Can I copy these examples directly?
Only after confirming the exact active senders and current provider instructions for your hostname.
How many includes are allowed?
SPF evaluation permits at most ten DNS-query-causing mechanisms across recursive evaluation, not simply ten include words.
Does the order of mechanisms matter?
Evaluation stops at the first match, so order affects only which mechanism matches, not the result for a listed sender. Keep all at the end.
Do subdomains inherit SPF?
No. Each hostname that sends mail, such as a MAIL FROM subdomain, needs its own SPF record.
Is the old SPF DNS record type still used?
No. Publish SPF as a TXT record; the separate SPF record type is obsolete.