Gmail users: If you’re getting spam or phishing messages in Gmail, go here instead. If you’re having trouble sending or receiving emails in Gmail, go here instead.
SPF helps prevent your outgoing email from being marked as spam by receiving email servers. Set up SPF by adding an SPF DNS TXT record (SPF record) to your domain.
An SPF record is a line of text that you add to your domain, following your domain provider’s instructions. The line of text uses special syntax and lists all the servers that send email for your domain. Here’s an example SPF record:
v=spf1 include:_spf.google.com ~all
When receiving servers get email messages from your domain, they check the SPF record to verify that the messages came from authorized servers.
On this page
- Before you begin
- Step 1: Identify all your email senders
- Step 2: Determine your SPF record
- Step 3: Add your SPF record to your domain
- Next steps
- Related topics
Before you begin
- You don’t need to set up SPF if your domain already has SPF set up by default, or if you bought your domain from a Google partner when you signed up for Google Workspace. To check if SPF is already set up for your domain, use one of many free tools available on the internet.
- You don’t need to do anything in your Google Admin console to set up SPF. Instead, determine your SPF record by following the instructions on this page. Then, log into your domain host and add the SPF record, following the domain host SPF instructions.
Step 1: Identify all your email senders
Your SPF record should include the domains (or IP addresses) of all servers that send email for your organization (domain).
In simple cases, all your email is sent using Google Workspace only. In other cases, your email senders might include the following:
- Web servers
- On-premise mail servers, for example Microsoft Exchange
- Mail servers used by your service host
- Outbound gateways
- Services that send automatic email, for example "Contact us" forms
- Any third-party provider or service that sends email for your domain
You might need get this information from your web site admin or any third-party services.
Step 2: Determine your SPF record
After you get the domains (or IP addresses) for all your email senders, determine your SPF record. Your SPF record is a text string that you’ll enter at your domain host, following the domain host SPF instructions.
If you use only Google Workspace to send email, copy this line of text: v=spf1 include:_spf.google.com ~all, then go to Step 3: Add the SPF record to your domain.
If you’re using any of the common senders in the table below, copy the SPF record and use it for your domain. Or, use the SPF records in the table as a guide. Replace the domains with the domains of your email senders.
About SPF record format and tags
- SPF records always start with the v=spf1 tag.
- Use the include: tag in front of each sender domain (or IP address) in your SPF record. An SPF record can have up to 10 include: tags.
- The ~all tag tells receiving servers to mark messages as spam if they’re from servers that aren’t listed in the SPF record. Google recommends you use ~all in your SPF record.
For detailed information about SPF record format and tags, visit About SPF records.
| For these senders | Use this SPF record |
|---|---|
| Google Workspace (only) | v=spf1 include:_spf.google.com ~all |
| Google Workspace and Amazon | v=spf1 include:_spf.google.com include:amazonses.com ~all |
| Google Workspace and GoDaddy | v=spf1 include:_spf.google.com include:secureserver.net ~all |
| Google Workspace and Mailchimp | v=spf1 include:_spf.google.com include:servers.mcsv.net ~all |
| Google Workspace and Microsoft Office 365 | v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all |
| Google Workspace and Salesforce | v=spf1 include:_spf.google.com include:_spf.salesforce.com ~all |
| Google Workspace and Shopify | v=spf1 include:_spf.google.com include:shops.shopify.com ~all |
| Google Workspace and Zendesk | v=spf1 include:_spf.google.com include:mail.zendesk.com ~all |
| Amazon (only) | v=spf1 include:amazonses.com ~all |
| GoDaddy (only) | v=spf1 include:secureserver.net ~all |
| Mailchimp (only) | v=spf1 include:servers.mcsv.net ~all |
| Microsoft Office 365 (only) | v=spf1 include:spf.protection.outlook.com ~all |
| Salesforce (only) | v=spf1 include:_spf.salesforce.com ~all |
| Shopify (only) | v=spf1 include:shops.shopify.com ~all |
| Zendesk (only) | v=spf1 include:mail.zendesk.com ~all |
Step 3: Add your SPF record to your domain
Important: Use your domain host’s SPF help documentation for this step. Steps for adding an SPF record vary, depending on the domain host.
- Sign in to your domain host, typically where you purchased your domain name. If you’re not sure who your domain host is, see identify your domain registrar.
- Go to the page where you update DNS TXT records for your domain. For help finding this page, check the documentation for your domain.
-
Add or update the TXT record with this information (refer to the documentation for your domain):
Field name Value to enter Type The record type is TXT. Host (Name, Hostname, or Alias) If the host is the same domain (not subdomain) you are adding the TXT record to, enter the @ symbol.
Otherwise, the value should be example.com (replace example.com with the domain name).
Value Enter the SPF record from Step 2: Determine your SPF record.
If you send email with Google Workspace only, enter: v=spf1 include:_spf.google.com ~all
Some domains require you to enclose the SPF record string in quotes. Check the help documentation for your domain host.
- If you use subdomains, you must add an SPF record for each subdomain. Check the documentation for your domain.
- If you are setting up SPF for more than one domain, complete these steps for each domain. Each domain must have its own SPF record.
It can take up to 48 hours for SPF authentication to start working. To verify that SPF is working, see Verify outgoing messages pass SPF authentication.
Next steps
- Google recommends that you also set up DKIM and DMARC authentication for your organization. Bulk senders are required to set up SPF, DKIM, and DMARC. For details, see Email sender guidelines.
- If you start using a new mail server or third-party sender, make sure to update your SPF record (earlier on this page). Otherwise, messages sent by the new senders could be marked as spam.
- Keep your SPF record up to date by removing any domains or IP addresses that you no longer use for sending email.
- If you can't figure out if SPF is working, or if messages from your domain are going to spam, see Troubleshoot SPF issues.
Related topics
Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.
