SPF is a TXT record in a domain's DNS that lists the servers allowed to send email as that domain. When an email arrives, the receiving server checks whether the server that sent it is on the list.
What it looks like
An SPF record for a domain that sends through Google Workspace looks like v=spf1 include:_spf.google.com ~all. The include adds Google's servers; ~all asks receivers to treat anything else as suspicious.
Why it matters for cold email
Gmail and Yahoo expect SPF from everyone who sends to them, and require it, with DKIM and DMARC, from anyone sending in volume. Without SPF, cold email is far more likely to land in spam or be rejected.
Common mistakes
- Two SPF records on one domain, which makes SPF fail outright. Merge them into one.
- More than 10 DNS lookups across includes, which also makes it fail.
- Forgetting a service that sends as your domain, such as a CRM or help desk.
~all or -all?
~all (softfail) asks receivers to treat other servers as suspicious; -all (fail) asks them to reject. Most senders use ~all and let DMARC decide what happens to mail that fails, which avoids losing real email from a service you forgot to list.
How to check yours
Look the record up with the DNS lookup, or build a new one with the SPF generator. The domain health checker checks SPF, DKIM and DMARC together.