SPF records: what they are and how to set one up

An SPF record is a DNS entry that lists which mail servers are allowed to send email for your domain. If you're using Flashcloud-hosted email, we set up SPF automatically when you add a domain, so most people never need to touch it. You only need to edit it yourself when you add a third-party sending service like Google Workspace, Mailchimp, or SendGrid on top of your existing mail.

The fix, if you're here because mail is failing: add that service's SPF include to your existing record instead of creating a second one. Two SPF records on the same domain will break authentication for everyone.

What SPF actually does

SPF stands for Sender Policy Framework. It's a TXT record published in your domain's DNS that tells receiving mail servers: "here are the IPs and hosts allowed to send mail as this domain." When someone emails you, the receiving server checks the sending IP against your SPF record. If it doesn't match, the message can be flagged, quarantined, or rejected, depending on the receiving server's policy.

SPF is one of three authentication mechanisms mail servers check, alongside DKIM (which signs messages cryptographically) and DMARC (which tells receivers what to do when SPF or DKIM fail). All three matter if you want reliable delivery; SPF alone isn't enough. See why are my emails going to spam for how the three fit together.

The record format

A typical SPF record looks like this:

v=spf1 +mx +a +ip4:203.0.113.10 ~all

• v=spf1 marks it as an SPF record. Always first.
• +mx allows servers listed in your domain's MX records to send mail.
• +a allows the server at your domain's A record.
• ip4: or ip6: allows a specific IP address.
• include: allows another domain's SPF record, used for third-party senders.
• ~all (soft fail) or -all (hard fail) sets what happens to everything not explicitly listed. Most records end in ~all.

For Flashcloud-hosted email, this record is created for you when you add a domain. You can check it under Domains → click your domain → DNS, looking for a TXT record starting with v=spf1.

Adding a third-party sender

If you send mail from another service in addition to your Flashcloud mailbox, you need to add that service to your existing SPF record with an include: directive, not replace it.

Google Workspace

If you're moving your domain's email to Google Workspace entirely (not just sending from it occasionally), the setup involves more than SPF: you also swap your MX records and configure DKIM. See using Google Workspace with your domain for the full walkthrough. The SPF piece alone looks like:

v=spf1 include:_spf.google.com ~all

Mailchimp, SendGrid, and similar

For transactional or marketing email sent from a separate platform while your primary mail stays with us, add their include alongside your existing mechanisms:

v=spf1 +mx +a include:sendgrid.net include:servers.mcsv.net ~all

Each provider's own documentation lists the exact include value to use. Copy it exactly; don't guess at the hostname.

Editing the record

Go to Domains → click your domain → DNS, find the existing SPF TXT record, and edit its value in place. Add your new include: directive before the final ~all or -all. Save, then wait for propagation, typically a few minutes to a few hours depending on the record's TTL.

Common mistakes

• Multiple SPF records. A domain can only have one SPF TXT record. If you add a second one for a new service instead of editing the first, most receiving servers treat this as a permanent error and SPF checks fail entirely.
• Too many DNS lookups. SPF allows a maximum of 10 DNS lookups per check. Each include:, a, and mx mechanism counts. Stacking many third-party services can hit this limit; if it does, some includes may need to be flattened or dropped.
• Forgetting SPF isn't enough alone. SPF checks the envelope sender, not the visible "From" address a recipient sees. DMARC is what ties SPF and DKIM results to that visible address and enforces a policy. Add DKIM and DMARC if you haven't; see why are my emails going to spam for the DKIM and DMARC setup.

When to contact support

If you've edited your SPF record and mail is still failing authentication, or you're not sure whether an existing record already covers your setup, open a ticket from Support → New ticket in the portal. A real person can check the record against your mail flow and confirm what's misconfigured.