SPF — authorising senders

SPF (Sender Policy Framework) is a DNS record on your sending domain that lists which servers are allowed to send email on its behalf. Mailbox providers check it to decide if a message claiming to be from your domain is legitimate.

Without an SPF record (or with an incorrect one), Gmail, Outlook, and Apple Mail are far more likely to push your campaigns to spam — or refuse delivery outright. SPF answers a simple question for the receiver: "Is the server that sent this email allowed to send for the From-address domain?"

How to set SPF up

1. On the sender-emails settings page, open the domain you want to send from — the verification wizard shows the exact TXT record you need to add.
2. In your DNS provider (Cloudflare, AWS Route 53, Transip, etc.), add the TXT record at the root of the domain. Most providers have a "TXT" record type in the DNS editor.
3. Wait for DNS to propagate — usually a few minutes, occasionally up to 24 hours. Re-run the verification in the wizard until it turns green.

🚧

Only one SPF record per domain

A domain can have at most one SPF TXT record. If you already have one (e.g. for Google Workspace), do not add a second — instead, merge the "include:" parts of both into the existing record. Two SPF records will fail validation for both.

📘

SPF on its own is not enough

SPF authorises the sending server but does not protect against forwarded mail (where the forwarder changes the path) and does not sign the content. Pair it with DKIM and DMARC for real protection.

Where do I add the SPF record?

At the root of your sending domain, as a TXT record. Most DNS providers (Cloudflare, AWS Route 53, Transip) have a "TXT" record type in their DNS editor.

I already have an SPF record for another service — what now?

A domain can only have one SPF record. Merge the "include:" part of our record into your existing one — do not add a second SPF record, that fails validation for both.

My SPF still shows as failing — why?

Most likely DNS hasn't propagated yet (can take up to 24 hours), or the value was copied with a stray space or character. Re-check the verification wizard for the exact expected value and try again.

Is SPF enough on its own?

No. SPF doesn't survive forwarding and doesn't sign content. Pair it with DKIM (which signs each email) and DMARC (which sets the failure policy) for real deliverability.

See also

• DKIM — signing your mail
• DMARC — tying it together
• What is a campaign