Before you set up SPF

Protect against spoofing & phishing, and help prevent messages from being marked as spam

Sender Policy Framework (SPF) is an industry-standard email authentication method. It’s an effective way to help protect your domain from spoofing, and to help prevent your messages from being marked as spam. So we recommend you always set up SPF for your organization.

Tip: If you send email with Google Workspace only, get your SPF record in Define your SPF record—Basic setup.

Note: If you bought your domain from a Google partner when you signed up for Google Workspace, you might not need to set up SPF records. Check if SPF is one of the Settings managed by your domain host.

Before your start: Check your current SPF and DKIM

Before you set up email authentication, use the Google Admin Toolbox to check if SPF and DKIM have been set up.

Take these steps before you set up SPF

Get the sign-in information for your domain provider

SPF is set up at your domain provider, not in your Google admin console. You’ll need the sign-in information for your domain provider.

If you're not sure who your domain provider is, go to Identify your domain host.

Understand IP addresses

An IP address is used to identify devices and connect to the internet. IP addresses let devices like computers, mobile devices, and servers communicate with each other. Servers that send and receive email are identified by their unique IP address. The SPF record for your domain might need the IP addresses for servers that send email for your domain.

IP version 4 (IPv4) addresses look like this: 203.0.113.42
IP version 6 (IPv6) addresses look like this: 2001:db8:14:5:1:2:bf35:2610

IP address blocks

IP addresses are typically assigned to networks in blocks. An IP address with a slash (/) indicates a block of IP addresses:

IPv4: 192.0.2.0/24
IPv6: 2001:db8:1234::/48

When you use an IP block address in your SPF record, the SPF record is applied to all IP addresses in the block.

Understand DNS TXT records

To set up SPF for your domain, add a DNS text (TXT) record in your domain provider's management console. TXT records are a type of DNS record that has information for servers and other sources outside your domain.

Learn more about TXT records.

Check if you have an existing SPF record (optional)

You might already have a TXT record set up for SPF with your domain provider. To check, use the Check MX feature in the Google Admin Toolbox:

Go to the Google Admin Toolbox.
Enter your domain name.
Click Run Checks!
When the test finishes, click Effective SPF Address Ranges.
Check the SPF results. They should include:
- _spf.google.com
- _netblocks.google.com followed by several IP addresses
- _netblocks2.google.com followed by several IP addresses
- _netblocks3.google.com followed by several IP addresses

Identify all email senders for your organization

Your SPF record must include references to all servers that send email for your organization or domain. These might include:

Web servers
On-premise mail servers, for example Microsoft Exchange
Mail servers used by your service provider
Outbound gateways
Services that send automatic emails, for example "Contact us" forms
Any third-party provider or service that sends email for your domain

If you send email with servers or services in addition to Google Workspace, gather those IP addresses or domains to include in your SPF record. You might need to contact your web site admin or third-party service documentation for this information.

Next steps

Now that you're prepared to set up SPF, define your SPF record:

For basic SPF record instructions and examples, go to Define your SPF record—Basic setup. If your organization sends email with Google Workspace only, go to this article.
For detailed information on SPF record format, contents, and how SPF affects email delivery, go to Define your SPF record—Advanced setup.

Was this helpful?

How can we improve it?