Write an SPF record for your domain

v=spf1 is easy to get subtly wrong — one extra include can blow the 10-lookup limit. Assemble the record from checkboxes instead of memory.

Tools used in this guide

The job

SPF tells receiving mail servers which hosts may send for your domain. Each mechanism is a keyword — a, mx, ip4:…, ip6:…, include:… — and the record ends in an all qualifier that says what to do with everything else.

Check, list, pick the tail

Tick 'a' and 'mx' for your own hosts, list literal ip4/ip6 addresses and include: targets, then pick the all qualifier — ~all (softfail) while you test, -all (fail) once it works. Redirect replaces all for delegated domains.

Worked example

Domain hosts plus one IPv4, a /24 range, and a provider's include with a softfail tail produces: v=spf1 a mx ip4:192.0.2.10 ip4:203.0.113.0/24 include:_spf.example.net ~all — three DNS lookups counted against the limit of 10 (a, mx, include).

Scope

Mechanisms a, mx, ip4, ip6, include, redirect, all; up to 10 entries per list, 450 characters total. Lookup counting is a local estimate — nested includes inside your provider's record also count, so leave headroom.