---
title: "Publish an SPF record · Agent Wranglers"
url: https://agentwranglers.se/playbook/email/sending-domain-and-authentication/spf
updated: 2026-10-20
licence: "All rights reserved"
---

# Publish an SPF record

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Sending domain and authentication](https://agentwranglers.se/playbook/email/sending-domain-and-authentication)
- Rule: Publish one SPF record for every domain that sends mail, listing every server and service that sends for it.
- How: SPF (RFC 7208) checks the envelope sender, the bounce address. Publish one TXT record starting `v=spf1`. List each sending service with `include:` or `ip4:`. Stay within 10 DNS lookups and 2 lookups that return nothing, or the check fails with a permanent error (RFC 7208, section 4.6.4). End with `-all` once the list is complete, or `~all` while you are still finding senders. Never use `+all` or `?all`. Two `v=spf1` records also make the check fail, so merge them into one.
- Check: `dig +short TXT example.com` shows exactly one `v=spf1` record, ending in `-all` or `~all`. An SPF checker counts 10 lookups or fewer, and a test message shows `spf=pass`.

Example:

```dns
example.com.          3600  IN  TXT  "v=spf1 include:_spf.mailprovider.example ip4:192.0.2.10 -all"
mail.example.com.     3600  IN  TXT  "v=spf1 include:_spf.newsletter.example -all"
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/sending-domain-and-authentication/spf`.

- Next: [Sign every message with DKIM](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/dkim)
- [Sending domain and authentication](https://agentwranglers.se/playbook/email/sending-domain-and-authentication)