Domain

This domain sends no email

Services that send as this domain

Microsoft 365 / Exchange Onlineinclude:spf.protection.outlook.comGoogle Workspaceinclude:_spf.google.comAmazon SESinclude:amazonses.comSendGridinclude:sendgrid.netMailguninclude:mailgun.orgPostmarkinclude:spf.mtasv.netMailchimp Transactional (Mandrill)include:spf.mandrillapp.comSalesforceinclude:_spf.salesforce.comZendeskinclude:mail.zendesk.com

Microsoft 365 also covers Azure Communication Services email. Mailchimp marketing and HubSpot normally send with their own return-path, so they usually need no entry here.

Your own servers

Servers in the MX recordsThe domain's web server (A record)

IP addresses or ranges

Printers, scanners, on-premises mail servers or a relay. IP entries cost no DNS lookups.

Other includes

From your provider's setup page, without the "include:" prefix.

Mail from servers not listed

Reject (-all)Mark as suspicious (~all)

TXT record at yourdomain (host @)

v=spf1 include:spf.protection.outlook.com -all

1 direct DNS lookup; the includes add their own nested lookups (limit 10 in total). Check the published record with the email domain checker.

Replace any existing v=spf1 record instead of adding a second one.

SPF in four rules

One record per domain

A domain may publish exactly one TXT record starting with v=spf1. Two records make SPF fail for every message, so add new senders to the existing record instead of creating a second one.

The 10-lookup limit

Every include, a, mx, exists and redirect costs a DNS lookup, and so do the includes inside them. Above 10, SPF fails with a permanent error. Large providers such as Google already use 3–4 of the 10, so check the finished record with the email domain checker.

-all or ~all

-all (hard fail) tells receivers to reject mail from servers that are not listed; ~all (soft fail) asks them to accept but mark it. With DMARC at quarantine or reject the difference is small; without DMARC, -all is the stronger choice.

SPF checks the envelope, not the From line

SPF validates the return-path (MAIL FROM) domain, which many bulk senders set to their own domain. That is why DMARC and DKIM matter: DMARC requires SPF or DKIM to align with the visible From domain.

Go further

Every domain in your tenant, checked

ConfigCobra's Microsoft 365 inventory lists domains without DKIM / DMARC next to the CIS Microsoft 365 checks, read-only.

Start free trial All free tools

SPF record generator