How to Set Up SPF Records
Step 1: Collect the IP address and email server used to send emails
The Sender Policy Framework (SPF) gives the ability to authenticate your email and to specify which IP address or email server is allowed to send email on behalf of the specific domain. The IP Address is optional, so to keep things simple you can just reference the email server. The email server is the one you send marketing emails from (Klaviyo, Mailchimp etc). At the bottom of this an additional step you can do to authenticate your Gmail server for any emails you send outside of marketing emails.
Step 2: Create your SPF record
The SPF record should be registered on the DNS zone of your domain name.
(assuming you use Google to send emails and Klaviyo to send marketing emails)
v=spf1 include:_spf.google.com include:klaviyo.com ~all
Both of these services are now authorized in one SPF record. You only need one SPF TXT record for your domain — merge all services you use into a single entry.
If you only want to validate Klaviyo, this is the record you would use:
v=spf1 include:klaviyo.com ~all
If you use HubSpot as well:
v=spf1 include:_spf.google.com include:klaviyo.com include:spf.hubspot.com ~all
If you use Mailchimp as well:
v=spf1 include:_spf.google.com include:klaviyo.com include:spf.mailchimp.com ~all
a. Start with the SPF version. This part defines the record as SPF
An SPF record should always start with the version number v=spf1 (version 1). This tag defines the record as SPF.
NOTE: There used to be a second version of SPF (called SenderID), but this was discontinued.
b. Follow with IP addresses (optional)
After including the v=spf1 SPF version tag, you can add any IP addresses that are authorized to send emails on your behalf (this is optional and only if you have your own mail server).
Example:
v=spf1 ip4:203.0.113.45
⚠️ Only add IPs if you directly control servers that send mail. Most businesses should rely on include: statements instead.
c. Add include tags
Next, add an include tag for every third-party provider that sends emails on your behalf.
Correct Example for Klaviyo:
include:klaviyo.com
You can include more than one service:
Example:
include:_spf.google.com include:klaviyo.com
d. End your record with an ~all or -all tag
Once you’ve added all IP addresses and include tags, end your record with ~all or -all.
The all tag tells mail servers what to do if an email is sent from a server that isn’t listed in your SPF record:
- -all → Hard fail. Rejects emails from unauthorized servers.
- ~all → Soft fail. Marks unauthorized emails as suspicious but still accepts them.
- +all → ⚠️ Never use this. It allows any server to send mail from your domain.
Step 3: Publish Your SPF Record
After defining your SPF record, it’s time to save your modification. By doing this, you publish your record into your DNS. It will take at least 24 hours to take effect.
How to Set Up DMARC Records
DMARC is short for Domain-based Message Authentication, Reporting, and Conformance. It aligns with SPF and DKIM and links the sender’s email address and domain name using records published on the DNS.
A legitimate email sometimes fails the SPF or DKIM test. Despite this, mailbox providers allow it to enter if it appears to come from a credible source. This is because DMARC clarifies the action required in such situations.
DMARC is a DNS TXT record that directs a recipient’s server on how to deal with emails coming from your domain. The server can ‘Quarantine, ‘Reject’, or ‘Allow’ a message as per your DMARC policy.
Make it a TXT Record, and _dmarc under Name/Host.
Creating a DMARC record is the same process as creating an SPF record. The value can look like this:
v=dmarc1; p=quarantine; pct=50; rua=mailto:dmarc-rua@example.com
DMARC tags specify aspects of DMARC implementations, and not all are as important or as used as the others.
They’re divided into the following three categories:
- Required: These tags are mandatory and you can’t miss them. Every DMARC TXT record begins with the mandatory ‘v’ or version tag and the corresponding value of ‘DMARC1.’
- Optional but recommended: It isn’t necessary to add these tags, but they help generate reports.
- Optional: You can skip these tags.
A total of 11 tags can be applied to a DMARC policy.
Of those 11, the “v” and “p” tags are mandatory, and the DMARC rua tag is optional but recommended for receiving the reports.
DKIM is not optional if you want proper authentication
- The text says “You only need to set a DKIM record up if …” which sounds optional.
- In reality, every sending domain should configure DKIM (along with SPF and DMARC) for deliverability and security.
- Better wording: “You need to set up a DKIM record for your domain if you send email. Without DKIM, your emails are more likely to fail authentication and land in spam.”
It doesn’t show the structure of a DKIM record
For clarity, the article should show what the DNS entry looks like. Example for Google Workspace:
Host/Name: google._domainkey
Type: TXT
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0B… (long public key)
This helps readers understand what they’ll actually paste into DNS.
Provider-specific instructions could be clearer
- Saying “refer to this link” is vague.
- It’s better to mention:
- Gmail/Google Workspace → Admin Console → Apps → Gmail → Authenticate Email.
- Microsoft 365 → Generate in Microsoft 365 Security/Exchange admin.
- Then add the DNS TXT record at the registrar (Namecheap, GoDaddy, etc.).
