Ivona Mikulčić | Updated September 4, 2026 | 18 min read

How to Create an SPF Record in 7 Steps (No More PermError)

I’ve watched teams spend weeks debugging reply rates, tweaking subject lines, A/B testing CTAs, only to discover the real problem was a broken SPF record silently eating their deliverability. One missing include: tag, one duplicate record, and suddenly 1 in 6 emails never reaches the inbox.
The global average inbox placement rate is 83.1% per EmailToolTester (50+ Email Deliverability Statistics in 2026: Benchmarks, Rates & Research-Backed Data), meaning 16.9% of legitimate emails never make it to the inbox. (50+ Email Deliverability Statistics in 2026: Benchmarks, Rates & Research-Backed Data) That gap is often caused by misconfigured or missing authentication records, and SPF is the first one you should fix.
In this guide, I’ll show you exactly how to create an SPF record, set it up for every major provider and registrar (including GoDaddy), and avoid the 10-DNS-lookup trap that triggers PermError. I’ll also cover the full SPF syntax most guides skip.
Table of contents
  1. What is an SPF record?
  2. What does an SPF record do?
  3. Create an SPF record in 7 steps
  4. Do you need to include lemlist in the SPF setup?
  5. Can you create multiple SPF records?
  6. Why you’re getting an SPF PermError (the 10-lookup limit)
  7. How do I check my SPF record with lemlist?
  8. How to set up SPF record for Microsoft Office 365
  9. How to add SPF records for a Google sending domain
  10. SPF record benefits to your cold outreach
  11. SPF tags explained
  12. Final thoughts
Generate your SPF record for free now
Create a valid SPF record for your domain in a few seconds with our free tool.
window.addEventListener(‘message’, function(event) {
if (event.source === document.getElementById(“myIframe2”).contentWindow && event.data.from == “iframe” && event.data.action == “resize”) {
let iframe = document.getElementById(“myIframe2”);
document.getElementById(“myIframe2”).style.height = (event.data.height + 10) + “px”;
}
});

What is an SPF record?

An SPF record (Sender Policy Framework) is an email authentication system that mail servers use to make sure that emails that appear to come from your domain actually do come from you.
SPF records allow you to specify which servers can send emails on your domain’s behalf. If unauthorized servers claim to be sending from your domain, the SPF record prevents those emails from getting authorized.
It’s designed to stop phishing attempts and scammers from sending fake messages that claim to be from legit domains.
Technically, you don’t have to set up an SPF record to send emails. But without one, ISPs (internet service providers) have no way to verify your sends are legitimate. That tanks your deliverability. I’ve seen domains go from 90%+ inbox placement to sub-60% simply because they launched outreach on a domain with no SPF record at all.
That’s why it matters: SPF protects your domain from spoofing and keeps your cold emails out of spam.

What does an SPF record do?

An SPF record identifies the mail servers that are allowed to send messages from your domain.
It’s a type of DNS TXT (Domain Name System “text”) record with a list of APIs, software, and services you’ve approved to send messages on your behalf.
It looks like this:
Quote Icon
v=spf1 include:_spf.google.com ~all
The syntax is divided into a version prefix and an include tag that precedes a server that can send email through your domain.
The version prefix explains that this TXT record is used for SPF checking. The include holds the authorized server.
The “~all” part instructs receiving servers on what to do if authorization fails.
Here are the primary settings for the “all” tag:
  • + Pass (+all) – An email sent with a server/IP address that doesn’t match the SPF record will get a pass anyway. (Almost never what you want.)
  • – Hard Fail (-all) – An email sent with a server/IP address that doesn’t match the SPF record will not pass SPF authentication.
  • ~ Soft Fail (~all) – An email sent with a server/IP address that doesn’t match the SPF record will soft fail SPF, which means the host should accept the mail but mark it as an SPF failure.

Create an SPF record in 7 steps

The SPF record needs to be published in your DNS by your DNS manager.
Here’s the step-by-step process. (I’ve trimmed the fat from the common 10-step guides you’ll see elsewhere, because half those steps were duplicates.)
Step 1. Log in to your domain account at your domain host provider.
Step 2. Locate the page for updating your domain’s DNS records (something like DNS Management or Name Server Management).
Step 3. Select the domain you want to modify.
Step 4. Open the DNS manager and navigate to the TXT (text) record section.
Step 5. Create a new TXT record.
Step 6. Set the Host field to “@” (which represents your root domain) and fill the TXT Value field with your SPF record (e.g. v=spf1 a mx include:exampledomain.com ~all).
Step 7. Specify the Time To Live (TTL), enter 3600 or leave the default, then click “Save” or “Add Record” to publish the SPF TXT record into your DNS.
Your new SPF record can take up to 48 hours to go into effect. Contact your domain host for help adding TXT records.

Test your SPF record with the SPF record checker

Setting up an SPF record is an essential part of your technical settings.
You can test your SPF record using the SPF Record Generator on MxToolbox to validate that your record is syntactically correct and resolving as expected.

Do you need to include lemlist in the SPF setup?

No. You should include the applications that send emails on your behalf but use their own SMTP in your SPF record.
lemlist uses your SMTP to send your email, so it’s more of a super-powered online email client than a bulk email-sending app.
However, the deliverability of emails sent by lemlist depends on the reputation of your domain. Setting SPF (and the next two records, DKIM and DMARC) will help you protect your domain’s reputation and improve the deliverability of your emails.
(If you want the full walkthrough on those other two records, here’s how to set up your DKIM record and how to set up your DMARC record.)

Can you create multiple SPF records?

No. Creating two separate SPF TXT records on the same domain will generate an “SPF PermError” and harm your deliverability. Always check for an existing SPF record on your domain before adding a new one.
You can, however, add multiple servers to the same SPF record. Copy your new include: statement in front of the old one and separate them with a single space.
For example, to add Outlook to the SPF record from the previous section:
Quote Icon
v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

Why you’re getting an SPF PermError (the 10-lookup limit)

This is the single biggest SPF gotcha I see teams run into, and most setup guides never mention it.
The 10-DNS-lookup limit comes from RFC 7208, which caps SPF evaluation at 10 DNS-querying mechanisms per check. (SPF Record Limitations: 10 DNS Lookup Limit Explained) If your SPF record triggers more than 10 DNS lookups, receiving mail servers return an “SPF PermError: too many DNS lookups,” and DMARC treats that as a hard fail. (SPF Record Limitations: 10 DNS Lookup Limit Explained)
Your emails get rejected, routed to spam, or silently dropped, even when they’re completely legitimate.

What counts toward the 10-lookup limit

The “include”, “a”, “mx”, “ptr”, and “exists” mechanisms as well as the “redirect” modifier do count against this limit. (SPF PermError: Too Many DNS Lookups - When SPF Record Exceeds 10-DNS-Lookup Limit - DMARCLY) The “all”, “ip4”, and “ip6” mechanisms do not require DNS lookups and therefore do not count against (SPF PermError: Too Many DNS Lookups - When SPF Record Exceeds 10-DNS-Lookup Limit - DMARCLY) the limit.
The tricky part: each include: can trigger nested lookups. If the domain you include has its own include: statements, those count too. Most domains exceed this limit without realizing it, often due to nested includes and outdated services. (SPF Record Limitations: 10 DNS Lookup Limit Explained)

How to fix it

To stay within the limit, remove unused services, avoid “ptr” and “mx” where possible, replace lookup-heavy mechanisms with direct IP references, and consider automated SPF record flattening. (SPF Record Limitations: 10 DNS Lookup Limit Explained)
SPF flattening resolves all your include: references into their underlying IP addresses and bakes them directly into the record, so each one no longer counts as a DNS lookup. The tradeoff: you need to keep flattened records updated when your vendors change their IPs, so manual flattening requires quarterly reviews at minimum. For a detailed breakdown, see Microsoft’s SPF configuration guide.
Quick checklist:
  1. Run your SPF record through an SPF Record Generator to get your current lookup count.
  2. Remove include: entries for services you no longer use. This is the most common and safest win.
  3. Replace lookup-heavy mechanisms with ip4: / ip6: where the vendor’s IPs are stable.
  4. If you’re still over 10, look into an automated flattening service.

How do I check my SPF record with lemlist?

If you’re using lemlist, it takes less than a minute to check if your SPF record is correctly set up.
(If you don’t have an account yet, you can sign up here, for free.)
The Deliverability Hub is a dedicated area in lemlist that brings your deliverability insights into one place, across lemwarm (Warm-up), lemlist (Outreach), and Inbox placements. (Monitor deliverability with lemlist Deliverability Hub | lemlist Help Center) Open the Deliverability Hub from your dashboard.
Navigate to the DNS Checks section and click “Refresh checks.”
In a couple seconds, you’ll get a full overview of your SPF record, MX record exchanges, DMARC record, email tests, and your Spamassassin score.
If you see the green “All good” sign, your SPF formatting is already set up and protecting you. If it needs configuring, follow the steps below.
Beyond the one-time check, lemlist’s Deliverability Hub also includes a Deliverability Boost that runs pre-send checks to surface risky content and configuration gaps, while Monitoring & Alerts tracks inbox-vs-spam ratios per mailbox, provider, and domain so you can catch reputation damage early. (How to Improve Email Deliverability? 11 tactics that kept …) And lemwarm’s automated warm-up keeps your sender reputation healthy over time by gradually building trust with mailbox providers.

How to set up SPF record for Microsoft Office 365

If Microsoft Office 365 is your email provider, here’s how to set up your SPF record for the relevant server.
We’ll start with a simple process you can follow for any domain provider, then add more specific steps for popular registrars: Namecheap, Cloudflare, Bluehost, and GoDaddy.
For the full official reference, check Microsoft’s SPF configuration guide.

How to set up Office 365 SPF record – for all domain providers

No matter what domain hosting you use, there are only a few steps:
  1. Go to the settings for your DNS provider
  2. Create a new record
  3. Choose “TXT”
  4. Put “@” in the name
  5. Put v=spf1 include:spf.protection.outlook.com -all in value
And save it.

SPF record setup for Microsoft Office 365 and Namecheap

If you’re using Namecheap:
  1. Log in to Namecheap
  2. Go to Domain list and choose your domain
  3. Go to Advanced DNS
  4. Click on “Add new record”
  5. Choose TXT record
  6. Put @ in “Host” or “Name”
  7. Put v=spf1 include:spf.protection.outlook.com -all in value
https://assets-global.website-files.com/5de921a1902d8d39a699f77e/64b7e63e78e27e135e8eb620_image (14).png

SPF configuration for Microsoft Office 365 and Cloudflare

To configure your SPF record for Microsoft Office in Cloudflare:
  1. Log in to Cloudflare
  2. Go to Domain list and choose your domain
  3. Go to DNS
  4. Click on “Add new record”
  5. Choose TXT record
  6. Put @ in “Host” or “Name”
  7. Put v=spf1 include:spf.protection.outlook.com -all in value
  8. Save it

Enable SPF record for Microsoft Office 365 and Bluehost

For Bluehost:
  1. Log in to Bluehost
  2. Go to Domain list and choose your domain
  3. Go to DNS
  4. Click on “Add new record”
  5. Choose TXT record
  6. Put @ in “Host” or “Name”
  7. Put v=spf1 include:spf.protection.outlook.com -all in value
  8. Save it
https://assets-global.website-files.com/5de921a1902d8d39a699f77e/64b7e6b0d6f88651dd0db8d6_image (14) copy 3-min.png

SPF record setup for Microsoft Office 365 and GoDaddy

GoDaddy is one of the most popular registrars, and the setup is straightforward. If your domain, DNS and email are in the same GoDaddy account, GoDaddy may add your SPF record for you automatically. (Add an SPF record to my domain for my email | Microsoft 365 from GoDaddy - GoDaddy Help US) If not, follow these steps:
  1. Sign in to your GoDaddy Domain Portfolio. (Add an SPF record | Domains - GoDaddy Help US)
  2. Under Domain Name, select your domain. Under your domain name, select DNS. (Add an SPF record to my domain for my email | Microsoft 365 from GoDaddy - GoDaddy Help US)
  3. Select Add New Record, and then enter the following details: Type: Select TXT. (Add an SPF record to my domain for my email | Microsoft 365 from GoDaddy - GoDaddy Help US)
  4. Put @ in “Name”
  5. Put v=spf1 include:spf.protection.outlook.com -all in Value
  6. TTL (Time to Live): leave it as Default (1 hour). (Add an SPF record | Domains - GoDaddy Help US)
  7. Click Save
Most DNS changes take effect within an hour but could take up to 48 hours to update globally. (Add an SPF record to my domain for my email | Microsoft 365 from GoDaddy - GoDaddy Help US) One thing to watch: your domain can only have one SPF record. If multiple SPF records are found on your domain, your email might not be delivered. (Add an SPF record to my domain for my email | Microsoft 365 from GoDaddy - GoDaddy Help US)

How to add SPF records for a Google sending domain

Now here’s how to add your Google domain to the SPF record mechanism for your domain provider.
You can also check Google Workspace’s SPF setup guide for the official reference.

How to set up your Google SPF record – for all domain providers

No matter what domain provider you use, follow the steps below to validate your SPF.
You can also check the documents and tutorials of your domain provider itself to see if they already give instructions on how to configure your SPF.
  1. Go to your DNS settings
  2. Create a new record
  3. Configure and choose “TXT”
  4. Add “@” in name
  5. Add v=spf1 include:_spf.google.com ~all in value
Save it to publish.

How to create a Google SPF record for Namecheap

If you’re using Namecheap:
  1. Log in to Namecheap
  2. Go to Domain list and choose your domain
  3. Go to Advanced DNS
  4. Click on “Add new record”
  5. Choose TXT record
  6. Put @ in “Host” or “Name”
  7. Add the tag v=spf1 include:_spf.google.com ~all in value
  8. Save it
https://assets-global.website-files.com/5de921a1902d8d39a699f77e/64b7e749e15c3158152787bd_image (14) copy 2-min.png

Adding a Google SPF record to Cloudflare

For Cloudflare users:
  1. Log in to Cloudflare
  2. Go to Domain list and choose your domain
  3. Go to DNS provider
  4. Click on “Add new record”
  5. Choose TXT record
  6. Put @ in “Name”
  7. Put v=spf1 include:_spf.google.com ~all in value
  8. Save it

How to set up Google SPF records for Bluehost

For Bluehost users:
  1. Log in to Bluehost
  2. Go to Domain list and choose your domain
  3. Go to Advanced DNS
  4. Click on “Add new record”
  5. Choose TXT record
  6. Put @ in “Host” or “Name”
  7. Put v=spf1 include:_spf.google.com ~all in value
  8. Save it
https://assets-global.website-files.com/5de921a1902d8d39a699f77e/64b7e6b0d6f88651dd0db8d6_image (14) copy 3-min.png

How to create a Google SPF record for GoDaddy

The GoDaddy flow for Google is nearly identical to the Office 365 version:
  1. Sign in to your GoDaddy Domain Portfolio
  2. Under Domain Name, select your domain, then select DNS
  3. Select Add New Record
  4. Type: Select TXT
  5. Name: Enter @
  6. Value: Enter v=spf1 include:_spf.google.com ~all
  7. TTL: Leave as Default
  8. Click Save
If you already have an SPF record with another provider’s include:, don’t create a second record. Add the Google include: to the existing record instead.

SPF record benefits to your cold outreach

A well-set SPF record is your key to a successful cold outreach campaign. Here’s how your SPF record helps:

1. Improves email deliverability

When you send emails through lemlist, recipient mail servers check your SPF record to verify that it is actually you sending the email. A correctly configured SPF record increases the likelihood that your emails will land in the recipient’s inbox rather than the spam folder.

2. Reduces email spoofing

An SPF record helps prevent others from sending emails pretending to be you. This protection enhances your domain’s reputation, making email providers more likely to trust and deliver your legitimate cold outreach emails.

3. Maintains domain reputation

Sending cold emails without a proper SPF record can result in a higher bounce rate and spam complaints, negatively impacting your domain’s reputation. A good reputation is what keeps your deliverability high over time, and you do not want to burn out the domain you spent months building a reputation for.

4. Compliance with email standards

Many email providers and anti-spam systems use SPF records as part of their filtering criteria. Compliance with these standards ensures that your emails align with best practices, supporting your outreach efforts.
This is especially important since Google and Yahoo! have released new, stricter email requirements. SPF is only one leg of the authentication tripod. You also need DKIM and DMARC. If you haven’t set those up yet, follow our DMARC setup guide and set up your DKIM record to stay compliant.

SPF tags explained

SPF tags (also called mechanisms and modifiers) are the building blocks of an SPF record. They define which mail servers are allowed to send emails on behalf of your domain.
Here’s the full list you need to know. (Most guides stop at three. I’ll cover all seven that matter.)

1. v tag (required)

The v tag, or version tag, declares the record as SPF. Without it, email servers wouldn’t recognize the string as an SPF record and would fail to enforce your sending policies.
Example: v=spf1

2. ip4 tag

The ip4 tag specifies authorized IPv4 addresses for sending emails from your domain. It’s one of the most direct ways to whitelist a sender, and since ip4 doesn’t trigger a DNS lookup, it doesn’t count toward the 10-lookup limit.
Example: v=spf1 ip4:192.0.2.1 ip4:198.51.100.0/24 -all

3. ip6 tag

This tag includes IPv6 addresses authorized to send on behalf of your domain. Like ip4, it does not count toward the DNS lookup limit.
Example: v=spf1 ip6:2001:db8::1 ip6:2001:db8:abcd:0012::0/64 -all

4. a mechanism

The a mechanism checks the A record (IPv4 address) of the specified domain. If the sending server’s IP matches the A record, the email passes. It counts as one DNS lookup.
Example: v=spf1 a -all
This says: “Only the IP address that my domain’s A record points to is allowed to send mail.”

5. mx mechanism

The mx mechanism checks whether the sending server’s IP matches any of the domain’s MX (mail exchange) records. It counts as one DNS lookup, plus one additional lookup per MX hostname resolved.
Example: v=spf1 mx -all
Use this sparingly. If your MX records point to multiple hosts, each one eats a lookup. I’ve seen a single mx mechanism consume four lookups by itself on domains with complex mail routing.

6. include mechanism

The include mechanism tells the receiving server to also evaluate the SPF record of another domain. It’s what you use when a third-party service (Google Workspace, Office 365, a marketing platform) sends mail on your behalf.
Example: v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all
Each include: counts as one DNS lookup, and any nested include: statements inside the referenced domain’s SPF record count too. This is where most people blow past the 10-lookup limit without realizing it.

7. redirect modifier

The redirect modifier replaces the current domain’s SPF evaluation with the SPF record of another domain entirely. It’s different from include: because it doesn’t fall back to the current record if the lookup fails.
Example: v=spf1 redirect=_spf.example.com
Use redirect when your domain’s mail policy is 100% defined by another domain’s SPF record. It counts as one DNS lookup.

Final thoughts

SPF is the first layer of email authentication. Without it, mailbox providers have no way to verify your sends are legitimate, and your outreach pays the price.
But SPF alone isn’t enough. You also need DKIM (to sign your messages cryptographically) and DMARC (to tell receivers what to do when authentication fails). Together, the three form the authentication baseline that Google and Yahoo now require.
Here’s where I’d start if you’re setting this up for the first time:
  1. Create your SPF record using the steps above.
  2. Set up your DKIM record.
  3. Publish your DMARC record.
  4. Verify everything in lemlist’s Deliverability Hub, which runs SPF, DKIM, DMARC, and MX checks in one place, then set up Monitoring & Alerts so you catch problems before they tank a campaign.
Warm-up through lemwarm is bundled into every plan through the Deliverability Hub, alongside inbox rotation, custom tracking domains, sending limits management, and deliverability alerts. (Lemlist Review 2026: Features, Pricing & Honest Verdict) That means you can go from zero authentication to full deliverability monitoring without stitching together separate tools.
lemlist is rated 4.6/5 on G2 from more than 2,000 reviews.
→ Start your 14-day free trial — no credit card required.
IvonaIvona Mikulčić
Product Marketing Manager
Share this post