Adding an SPF record at your DNS provider

You add an SPF record as a TXT record on your domain name, in the DNS management of whichever party runs the nameservers for your domain. A domain may only have one SPF record: if one already exists, you put the 2Mail include reference into that existing record, before the closing ~all or -all. The exact value is shown in the 2Mail dashboard under your sending domain; below you can read where to enter it at the most common DNS providers.

What to have ready

• The 2Mail SPF entry. Open your sending domain in the dashboard. Under authentication you see a short include reference to 2Mail. Copy it literally.
• Access to the right DNS management. What counts is not where you bought the domain, but where the nameservers point. If they are at Cloudflare, a change in your registrar's panel has no effect whatsoever.
• The current record. Enter your domain in the free SPF, DKIM and DMARC checker: you see at once whether an SPF record already exists and what is in it.

Adding the record in five steps

1. Open the DNS management and look for a TXT record on your domain that starts with v=spf1.
2. If there is none yet: create a new record of type TXT. The name is the domain itself; in most panels that is an at sign (@) or an empty field. The value starts with v=spf1, followed by the include reference from your 2Mail dashboard, and ends with ~all.
3. If there already is one: edit that record and paste in the 2Mail include reference, with a space before and after it, before the closing all. Leave everything else untouched.
4. Save and leave the TTL as it is.
5. Go back to your sending domain in the dashboard and let 2Mail check the record.

One record: how to merge

Receiving servers accept exactly one SPF record per domain. If they find two, the check fails for every sender, including the service that had been working fine for years. So every service that sends on your behalf gets a place in the same record. If you use Microsoft 365 for your office mail, for example, the record probably reads v=spf1 include:spf.protection.outlook.com -all right now. After the change it becomes: v=spf1, then include:spf.protection.outlook.com, then the include reference from your 2Mail dashboard, and finally -all. The order of the include references does not matter; the all part does have to come at the very end.

Where to add the record, per DNS provider

Panels get redesigned regularly, so the buttons may be named slightly differently for you. The route to them stays the same.

• Cloudflare — select your domain, open the DNS section and then the records. Add a record with type TXT, name @ and the value in the content field. The proxy toggle (the orange cloud) does not exist for TXT records; there is nothing to do there.
• Combell — open your domain name in the control panel and go to the DNS management; TXT records have their own section there. For the domain itself, leave the name field empty or enter @, whichever the panel indicates.
• one.com — in the control panel, go to the DNS settings and then to the DNS records. Create a record of type TXT. The panel already shows your domain after the name field: for the domain itself that field usually stays empty.
• TransIP — open your domain in the control panel and scroll to the DNS section. Add a line with name @, type TXT and the value. Then click save at the bottom: without that click the line is lost.
• OVHcloud — open your domain name in the Manager and choose the DNS zone tab. Add an entry of type TXT and leave the subdomain field empty. The same list also offers an input helper for SPF; with TXT you simply paste the value as it is. At OVHcloud, allow a few hours up to a day before the change is visible everywhere.
• GoDaddy — open the domain in your product overview and choose the DNS management. Add a new record with type TXT, name @ and the value.
• Microsoft 365 — only applies if the DNS of your domain is hosted by Microsoft itself, for instance because you bought the domain through Microsoft. In the admin centre you find the domains under the settings; select your domain, open the DNS records and add a custom record. If your DNS is hosted elsewhere, that screen only shows which records Microsoft expects, and you edit them at your actual DNS provider. In both cases an SPF record for Microsoft is already there: so merge.

The limit of ten DNS lookups

A receiving server may perform at most ten DNS lookups while evaluating your SPF record. Every include counts, as do the a, mx, exists and redirect parts, and so do the lookups nested inside an include reference. The ip4, ip6 and all parts cost nothing. Go over ten and the whole record fails, even for the senders listed at the front. So remove the references to services you no longer use: the old newsletter tool, the previous hosting company, the CRM from three years ago. The checker counts the lookups for you.

~all or -all?

The last part tells a recipient what to think of servers that are not in the record. With ~all (softfail) they are suspicious, with -all (fail) they are explicitly not allowed. If your record already has a closing part, leave it as it is. If you start from scratch, choose ~all until you are certain that every service sending on your behalf is in the record; after that you can move to -all. Never use +all, because it approves every server in the world, and avoid ?all, because no recipient draws any conclusion from it.

Checking and waiting

The check in the dashboard is the reference: once it turns green, mail through our relay leaves with a positive SPF result. A new record is usually visible within the hour. A changed record keeps giving the old answer for as long as the previous TTL said. Your own computer and your internet provider remember that old answer too; so do not test ten times in a row from your own device, but use the checker or the check in the dashboard.

Common mistakes

• A second record — the most common mistake. Merge into one record and delete the other.
• Quotation marks — some panels put quotation marks around the value themselves, others expect you to leave them out. Follow the panel and do not type any extra. If you copy the value from an email or a Word document, check that no curly quotation marks came along: they make the record invalid.
• The name field — if you enter your full domain as the name while the panel already appends it, the record ends up on yourdomain.com.yourdomain.com and nobody finds it.
• The wrong domain — SPF belongs on the domain of your sender address, not on the domain of your website if they differ.
• The SPF record type — some panels still offer a separate record type called SPF. That type has been retired; recipients only look at TXT.
• The wrong panel — the record sits at your registrar, but the nameservers point to another party.

SPF alone is not enough. Next, switch on DKIM with activating a DKIM key and draw up a DMARC policy with the DMARC record generator. How the three records work together is explained on SPF, DKIM and DMARC.

Frequently asked questions

Can I have two SPF records if each one serves a different service?

No. However many services send on your behalf, they all belong in one record. Two records produce a permanent error, and recipients then ignore both of them.

Does a subdomain need its own SPF record?

Yes. SPF is not inherited from the main domain. If you send from a subdomain, for instance a separate domain for newsletters, that subdomain gets its own TXT record with its own v=spf1 value.

My record is getting too long. What now?

A single string in a TXT record may contain at most 255 characters. Most panels split a longer value into pieces within the same record by themselves, and that is allowed. If your record gets that long, you are probably also close to the limit of ten lookups: cleaning up then helps more than splitting.

Why does SPF fail on forwarded mail?

If a recipient automatically forwards your message to another address, it leaves from a server that is not in your record. That is normal and cannot be solved with SPF. The DKIM signature does stay valid when mail is forwarded, and that is exactly why you set up both.

Still stuck?

Send us your domain name and a screenshot of the record as it appears in your panel via contact. We tell you what needs to change.