An SPF record that actually passes is a single TXT at your domain apex. It lists every host allowed to send mail for that domain and ends with -all once the list is complete. Receivers check the envelope sender, not the From header, so the published string has to match how mail really leaves your systems.
Start by reading what is already live:
dig +short example.com TXT | grep spfYou want exactly one string that begins with v=spf1. Two SPF strings cause a permerror. A second “add SPF” click in a panel is a common way that happens. Merge everything into one record. If grep returns nothing, there is no SPF, and strict receivers will treat the domain as unsigned.
What belongs in the SPF string
On LogicWeb mail, begin with v=spf1 include:logicweb.com -all. That include covers the shared outbound hosts. If Mailchimp, Google Workspace, or a payment provider also sends as this domain, add each provider’s current include: from their own docs. Nested includes count toward the ten-lookup limit. Extra includes are not safer; they can blow the cap and fail closed.
Receivers evaluate MAIL FROM / Return-Path. A clean From header does not earn an SPF pass when the bounce address belongs to someone else. That is why blind forwarding is awkward, and why DMARC alignment is a separate step.
Soft fail versus hard fail
~all is a soft fail. It is useful while you are still finding every legitimate sender. -all is a hard fail. Once your reports look quiet and every real source is in the record, switch to -all. Leaving soft fail forever lets spoofed mail slip through with little resistance.
Publish, then verify the pass
Flattening includes to raw IPs can dodge the lookup cap until those IPs change and the record goes stale. Stay under ten lookups and count nested ones. After you publish, send a test message to a mailbox you control and read Authentication-Results. spf=pass on the envelope domain is the goal. SPF alone is not enough for modern policy, so publish DKIM next. See DKIM: generate, publish, verify.
Tagged
Was this article helpful?
Be the first to rate this article.
