An SPF record is a single line of text published in your domain's DNS zone that tells mailbox providers which servers are allowed to send email on your behalf. This guide walks through creating one correctly, avoiding the most common mistakes, and verifying it works.
Before you start
Make a list of every service that sends email using your domain name. This typically includes your everyday mailbox provider, plus anything else sending on your behalf: a marketing or newsletter platform, a support ticketing system, a CRM, or an invoicing tool. Each one needs to be accounted for in your record, or its mail may fail authentication.
Step-by-step instructions
- Open your domain's DNS zone. If Avalon hosts your domain, this is available from your Avalon hosting control panel's DNS management section. If your domain is registered elsewhere, log in to that registrar instead.
- Create a new TXT record. Set the host or name field to your root domain (often shown as "@") and the record type to TXT.
- Write the record value. Start with the SPF version tag, add an entry for each authorized sending service, and end with a catch-all rule. A record covering two sending services might look like:
v=spf1 include:mailservice.example.com include:helpdesk.example.com -all - Save and publish the record.
The ending tag matters: a strict catch-all (commonly written as a hyphen before "all") tells receiving servers to reject mail from unlisted sources, while a softer version marks it as suspicious without necessarily blocking it. Most domains start with the softer setting while confirming every sender is accounted for, then tighten it once confident.
Avoiding the 10-lookup limit
SPF checks are capped at 10 DNS lookups per verification. Each included sending service can itself require one or more lookups, so a record referencing several third-party platforms can quietly exceed that cap — especially since providers sometimes change their own records without notice. When the limit is exceeded, the entire SPF check fails, even if every entry was written correctly. To stay under the limit: remove services you no longer use, use direct IP addresses instead of service includes where a provider offers stable IPs, and avoid adding services you don't actually need listed.
Common mistakes
- Publishing a second SPF record instead of adding to the existing one — a domain must have exactly one
- Typos in a sending service's domain name within the record
- Forgetting to add a newly adopted email tool to the record
- Leaving the record on the loosest catch-all setting indefinitely instead of tightening it over time
How to verify your record
After publishing, confirm three things: the record starts with the correct version tag and ends with a catch-all rule, every included service resolves without errors, and the total lookup count stays under the limit. Most DNS changes take effect within 15 to 30 minutes, though it can occasionally take longer, so allow some time before testing. It's worth rechecking periodically, since a change on a third-party sending service's end can affect your lookup count without any action on your part.
FAQ
Where exactly do I add this record? In your domain's DNS zone — from your Avalon hosting control panel if Avalon manages your DNS, or your domain registrar's dashboard otherwise.
What happens if I already have an SPF record? Edit the existing one to add the new service rather than creating a second record, since a domain should only have one.
Is SPF alone enough to stop my email going to spam? It's an important piece, but pairing it with DKIM and DMARC — and building a consistent sending history — gives the strongest overall result.
