How to Create an SPF Record (With Examples for cPanel, Google Workspace and Microsoft 365)

Overview

An SPF record is a single TXT record on your domain that lists every server allowed to send email as you. It starts with v=spf1, lists your senders, and ends with ~all or -all. For a domain whose mail is hosted in cPanel, it looks like v=spf1 +a +mx +ip4:203.0.113.10 ~all, with your server’s IP in place of the example address. If your website and mailboxes are both on Host & Tech cPanel shared hosting, that one line is all you need.

This guide shows how to create an SPF record that covers everything that sends mail for your domain, with copy-ready examples for cPanel hosting, Google Workspace, Microsoft 365 and Zoho, and for domains that never send mail. It also covers the two mistakes that break SPF without any obvious error: publishing two SPF records, and going over the 10-lookup limit.

It’s written for domain owners and small business admins. If you’re on a VPS and want to set SPF, DKIM and DMARC for every account on the server, see how to configure email authentication in WHM.

Prerequisites

• Access to wherever your domain’s DNS is hosted: cPanel’s Zone Editor if your nameservers point to your hosting, otherwise your registrar or DNS provider (Cloudflare, GoDaddy and so on). Check which with our guide to DNS records if you’re unsure.
• Your hosting server’s IP address. It’s shown in cPanel’s General Information panel as the Shared IP Address, or in your client area.
• A list of every service that sends email using your domain. Step 1 helps you build it.

Step-by-Step: Create Your SPF Record

Step 1: List everything that sends mail as your domain

SPF only works if the record covers every sender. Miss one and that service’s mail starts failing SPF the moment you publish. Go through this list:

• Your mailboxes: cPanel hosting, Google Workspace, Microsoft 365, Zoho or another provider.
• Your website: contact forms, WooCommerce order emails and password resets usually send from the hosting server, even when your mailboxes are with Google or Microsoft.
• Newsletter and marketing tools, helpdesks, CRMs, invoicing and booking systems.
• Printers, scanners or office systems that email reports.

For each third-party service, look in its help pages for the SPF include: value it asks you to add. Some newer services authenticate only with DKIM and don’t need to be in SPF at all.

Step 2: Build the record

An SPF record is built from these parts:

Pick the example that matches your setup and replace 203.0.113.10 with your server’s IP.

Mail and website both on cPanel hosting:

v=spf1 +a +mx +ip4:203.0.113.10 ~all

Mailboxes on Google Workspace, website on cPanel hosting:

v=spf1 ip4:203.0.113.10 include:_spf.google.com ~all

Mailboxes on Microsoft 365, website on cPanel hosting:

v=spf1 ip4:203.0.113.10 include:spf.protection.outlook.com ~all

Mailboxes on Zoho Mail, website on cPanel hosting:

v=spf1 ip4:203.0.113.10 include:zohomail.com ~all

A domain that never sends email (parked domains, redirects, old brand names):

v=spf1 -all

Spammers favour domains with no SPF record at all. Publishing v=spf1 -all on a domain you don’t send from tells receivers that nothing legitimate ever comes from it.

Note: The last three examples use ip4: instead of +a +mx on purpose. Once your mail is on Google, Microsoft or Zoho, your MX points at their servers, which the include already covers, and each a or mx costs a DNS lookup. ip4: is also the right choice if your site sits behind Cloudflare’s proxy, because your A record then points at Cloudflare, not at the server that sends your mail.

Step 3: Choose ~all or -all

• ~all (soft fail) asks receivers to accept but distrust mail from unlisted servers. Start here. Google Workspace recommends it.
• -all (hard fail) asks receivers to reject it. Microsoft recommends it for Microsoft 365 domains that also have DKIM and DMARC.

In practice, DMARC decides what finally happens to failing mail, so the difference is smaller than it looks. Publish with ~all, watch for a couple of weeks that everything legitimate passes, then move to -all if you want to.

Step 4: Add the record in cPanel or at your DNS provider

In cPanel:

1. Go to Domains > Zone Editor and click Manage next to your domain.
2. Filter by TXT and look for an existing record starting with v=spf1. If there is one, click Edit and replace its value. Don’t add a second one.
3. If there isn’t one, click Add Record, choose TXT, set the name to your domain (yourdomain.com.), paste the record as the value and save.

At a registrar or Cloudflare the fields are the same: type TXT, name @ (meaning the domain itself), value is the record, TTL on automatic. For more on the Zone Editor, see how to set up a DNS zone in cPanel.

Warning: Two TXT records that both start with v=spf1 make SPF fail for every message from your domain. When a service tells you to “add an SPF record”, merge its include: into your existing record instead.

Verify your SPF record

After saving, check what the world sees. Changes usually show within minutes, but can take longer; see DNS propagation time.

dig TXT yourdomain.com +short | grep spf1

On Windows:

nslookup -type=txt yourdomain.com

You should see exactly one line starting with v=spf1. Then send a test message to a Gmail address, open it, and choose Show original. The summary at the top should read SPF: PASS with your sending IP. In Outlook.com, look for spf=pass in the message headers.

Common Issues & Troubleshooting

SPF PermError: too many DNS lookups

Cause: Receivers stop evaluating SPF after 10 DNS lookups and treat the record as broken. Each a, mx and include: counts, and so does every lookup inside the included records. Three or four marketing tools plus Microsoft 365 can pass 10 quickly.

Fix: Remove services you no longer use, replace a and mx with the ip4: address they resolve to, and check whether any service now authenticates with DKIM only. An online SPF checker will show the lookup count for your record.

Multiple SPF records found

Cause: Two TXT records beginning with v=spf1 exist, usually because a new service’s setup guide said to add one. SPF then returns a permanent error for all your mail.

Fix: Combine them into one record with a single v=spf1 at the start and a single ~all or -all at the end, then delete the other.

SPF softfail or fail on mail from your website

Cause: Your mailboxes moved to Google or Microsoft and the record was replaced with only their include, so mail sent by your website from the hosting server is no longer listed.

Fix: Add ip4: with your hosting server’s IP back into the record. If contact form mail still goes missing, check Email Routing as described in cPanel email not receiving or sending.

The record doesn’t show up after saving

Cause: It was added in the wrong place (cPanel’s Zone Editor while the nameservers point elsewhere, or the other way round), or with the name set to something like spf instead of the domain itself.

Fix: Check your nameservers with dig NS yourdomain.com +short and edit DNS wherever they point. The record’s name must be the bare domain (@) unless you’re setting SPF for a subdomain that sends mail.