Sending domain and authentication Required

Publish an SPF record

Publish one SPF record for every domain that sends mail, listing every server and service that sends for it.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

SPF (RFC 7208) checks the envelope sender, the bounce address. Publish one TXT record starting v=spf1. List each sending service with include: or ip4:. Stay within 10 DNS lookups, or the check fails with a permanent error. End with -all once the list is complete, or ~all while you are still finding senders. Give domains that never send v=spf1 -all.

Example

example.com.          3600  IN  TXT  "v=spf1 include:_spf.mailprovider.example ip4:192.0.2.10 -all"
mail.example.com.     3600  IN  TXT  "v=spf1 include:_spf.newsletter.example -all"
parked.example.net.   3600  IN  TXT  "v=spf1 -all"

How to check

dig +short TXT example.com shows exactly one v=spf1 record. An SPF checker counts 10 lookups or fewer, and a test message shows spf=pass.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/sending-domain-and-authentication/spf.