SPF for Newsletters: One Record, Every Sender Listed

SPF is the list of servers allowed to send mail as your domain. When Gmail receives a message, it checks the server that sent it against that list. Gmail and Yahoo have expected SPF from bulk senders since February 2024, alongside DKIM and DMARC.

It’s also the record most likely to be quietly broken, because every new tool that sends email adds to it.

How a record is built

SPF is a TXT record on your domain. A typical one:

v=spf1 include:_spf.google.com include:mail.example-esp.com ~all

• v=spf1 says it’s an SPF record.
• include: adds a service that sends for you, using that service’s own list.
• ip4: and ip6: add specific server addresses.
• a and mx add the servers behind your domain’s web and mail records.
• The all at the end says what to do with everyone else.

The one-record rule

A domain can publish only one SPF record. With two, receivers treat SPF as broken and ignore both. This happens all the time: a new tool’s setup guide says “add this SPF record,” and someone adds a second one instead of merging it into the first.

Fix it by combining every include: into a single record.

The 10-lookup limit

SPF allows at most 10 DNS lookups per check. Every include:, a and mx counts, and so do the includes inside each include. Go over, and SPF fails even though every sender is listed.

If your record has grown long, remove services you no longer use before adding new ones.

The ending: ~all or -all

• ~all (soft fail) asks receivers to accept but mark mail from unlisted servers.
• -all (fail) asks them to reject it.
• +all and ?all vouch for anyone and defeat the point. Never use them.

~all is the safer choice while you’re still finding every service that sends as you.

What your newsletter platform needs

SPF checks the domain in the message’s return path, the hidden address bounces go back to, not the From address your readers see. Many email platforms use their own domain there. Your mail still passes SPF, but for the platform’s domain, not yours.

That matters for DMARC, which only counts SPF when the return-path domain matches your From domain. If your platform offers a custom bounce or return-path domain, set it up. If not, DMARC relies on DKIM, so make sure DKIM is set up on your own domain.

Frequently asked questions

Can a domain have two SPF records? No. Combine them into one.

Is SPF enough on its own? No. SPF checks the server, not the message, and it often breaks when mail is forwarded. Receivers want DKIM and DMARC too.

How do I check my SPF record? The SPF checker looks it up and flags a missing record, two records and endings that vouch for anyone. It checks DKIM and DMARC at the same time, free, with no signup.