What is SPF?
SPF stands for Sender Policy Framework. It's a simple technical rule you add to your domain (your website address, like yourbakery.co.uk) that tells email providers which computers are allowed to send email on your behalf.
Think of it like a staff list on your front door. When an email arrives claiming to be from you, the receiving email provider checks your SPF record — a short line of text stored in your domain settings — to see if the sender is on the list. If they're not, the email gets treated with suspicion and often lands in spam.
Why does this actually matter for my business?
If you send invoices, booking confirmations, or newsletters, whether those emails actually reach people depends partly on whether you have SPF set up correctly.
Without SPF, your emails look suspicious to providers like Gmail and Outlook, even if you wrote every word yourself. The inbox providers have no way to verify the email genuinely came from you.
This is not just a problem for big companies. Small businesses sending from platforms like Mailchimp, Squarespace, or even a basic cPanel (the control panel many web hosts use to manage emails) are affected just as much.
How does SPF actually work?
SPF works by checking a public record stored in your domain's DNS (Domain Name System, the internet's address book that links your domain name to the correct computers).
Here is the basic process, step by step:
- You send an email from your business address, say hello@yourbakery.co.uk.
- The recipient's email provider looks up your SPF record in your DNS settings.
- It checks whether the computer that sent the email is listed as authorised in that record.
- If it is authorised, the email is allowed through normally.
- If it is not listed, the email may be marked as spam, rejected entirely, or flagged as a potential forgery.
The SPF record itself looks something like this:
v=spf1 include:mailgun.org include:_spf.google.com ~all
You don't need to write that from scratch. Your email platform will give you the exact text to copy and paste.
What happens if I do not have SPF set up?
SPF is not legally required, but without it you are making your emails much harder to deliver reliably.
Here is what can go wrong:
- Emails land in spam. This is the most common symptom. Your customers may never even see your messages.
- Scammers can impersonate you. Without SPF, it is much easier for fraudsters to send emails pretending to be from your address. This can damage your reputation with customers.
- Email providers penalise you over time. Repeated delivery failures can reduce your sender reputation (a score email providers give your domain based on how your emails behave), making future emails even less likely to arrive.
For more on the wider causes of poor email delivery, have a read of our guide on why your emails are going to spam.
How do I check if SPF is already set up?
You don't need to log in to anything complicated. There are free tools that will check your domain in seconds.
Two reliable options:
- MXToolbox SPF checker (mxtoolbox.com/spf.aspx) is a free, widely used tool. Type in your domain and it will tell you whether an SPF record exists and whether it looks correct.
- Google Admin Toolbox (toolbox.googleapps.com) is Google's own checker and is particularly useful if you use Google Workspace (Google's paid suite of business tools including Gmail, Docs, and Drive) for your email.
Type your domain into either tool and look for a line starting with v=spf1. If you see one, you have an SPF record. If you see nothing, or an error, you need to add one.
How do I set up SPF?
SPF is set up by adding a TXT record (a plain text entry) to your domain's DNS settings. This is usually done through your domain registrar (the company you bought your domain from, such as GoDaddy, Namecheap, 123 Reg, or similar).
The exact text you need depends on where you send your emails from. Your email platform will tell you what to copy and paste.
Google Workspace
Go to your domain registrar's DNS settings. Add a new TXT record. In the value field, paste: v=spf1 include:_spf.google.com ~all
Save and allow up to 48 hours for it to take effect.
Microsoft 365
Add a TXT record to your DNS with this value: v=spf1 include:spf.protection.outlook.com ~all
Microsoft's own setup guide walks you through this step by step in their admin centre.
Mailchimp
Mailchimp handles sending from its own servers, so you need to add their authorised servers to your SPF record. Mailchimp's help pages give you the exact include: value to add.
If you also send from Google or another provider, you can combine them: v=spf1 include:servers.mcsv.net include:_spf.google.com ~all
cPanel Hosting (most small business hosts)
Log in to your hosting control panel. Go to Zone Editor or DNS Zone Manager. Add a TXT record for your domain with the value your email provider specifies. If in doubt, ask your host's support team. They do this every day.
⚠️ You can only have one SPF record per domain. If you use multiple email services — Google Workspace for your main email and Mailchimp for newsletters, say — you must combine them into a single SPF record. Two separate SPF records breaks SPF entirely and can make things worse than having none at all.
The difference between SPF, DKIM, and DMARC
You may have heard these three terms mentioned together. They work as a set, and understanding how they relate to each other helps.
| Term | What It Does | Analogy |
|---|---|---|
| SPF | Confirms which servers are allowed to send email for your domain | The staff list on the door |
| DKIM | Adds a digital signature to each email to prove it has not been tampered with | A wax seal on a letter |
| DMARC | Sets the rules for what happens if SPF or DKIM checks fail | The manager who decides what to do if the seal is broken |
SPF is the right place to start, but if you want proper protection, all three should be set up. Our guide on what DMARC is and how to set it up covers that next step in plain English.
Common SPF mistakes to avoid
- Having two SPF records. As mentioned above, this breaks things. Combine everything into one record.
- Forgetting to include all your sending services. If you send from your website contact form as well as Gmail, both need to be listed.
-
Using -all instead of ~all at the end. The
~allending (called a soft fail) is more forgiving and recommended for most small businesses. The-allending (hard fail) can cause legitimate emails to be rejected if anything is slightly misconfigured. - Not checking after making changes. Use MXToolbox again after any updates to confirm everything looks correct.
A quick summary
To pull it all together:
- SPF is a record in your DNS that tells email providers who is allowed to send email from your domain.
- Without it, your emails are more likely to land in spam or be used by fraudsters.
- You set it up by adding a TXT record to your domain's DNS, using the text your email provider gives you.
- You can only have one SPF record, so combine all your services into a single line.
- SPF works best alongside DKIM and DMARC.
If you are not sure where things stand with your domain right now, you can run a free check at website.auditmy.co.uk. It checks your SPF record along with a range of other factors that affect how your business appears online, and it takes about thirty seconds.
💡 Once your SPF is sorted, the next step is setting up DMARC, which gives you control over what happens when someone tries to fake emails from your domain. Read our guide on what DMARC is and why it matters to see how straightforward it can be.
SPF is defined in RFC 7208, published by the Internet Engineering Task Force (IETF), the body responsible for core internet standards. Google's email sender guidelines, updated in 2024, now require SPF authentication for anyone sending significant volumes of email to Gmail accounts.
Top comments (0)