SPF publishes which systems may send for an envelope-sender domain. It does not configure receiving mail, and it does not by itself authenticate the visible From address.
- List every service that sends mail for you: your mailbox provider, website forms, billing platform and newsletters. Obtain their exact DNS instructions.
- Run SPF for the envelope-sender domain. Publish one TXT record beginning
v=spf1at that name. Multiple separate SPF records cause an error; multiple quoted strings inside one TXT record are different and are joined together. - If two providers request SPF, combine their authorized terms into one policy with provider guidance. Preserve unrelated verification TXT records.
- Review broad authorization such as
+all. Do not paste a generic policy or switch to-allbefore accounting for legitimate senders. - Check nested includes and redirects with your provider. The checker counts top-level DNS-triggering terms only; it cannot certify the ten-term evaluation limit.
Finally, send a normal test message to an account you control and inspect its Authentication-Results header. SPF results depend on the actual sending IP and envelope domain. Forwarding may change the result.
Reference: SPF specification.