DNS guide
Google Workspace SPF Record
The Google Workspace SPF record is v=spf1 include:_spf.google.com ~all, published as a TXT record at your root domain (@). If other services send as your domain, add their include to that same record.
- Type
- TXT
- Host
- @
- TTL
- Default
- Value
- v=spf1 include:_spf.google.com ~all
Explained
The Google Workspace SPF record, part by part
Three parts, one job: tell receiving servers that mail for your domain may come from Google, and that anything else is suspicious.
Anatomy of the Google Workspace SPF record
Receivers read it left to right and stop at the first part that matches the sending server.
Copy this (TXT record, host @)
v=spf1 include:_spf.google.com ~all_spf.google.com is a record Google maintains with the IP ranges its mail servers use, so you never need to list Google IPs yourself. When we checked it in October 2026 it contained only IP ranges, so it costs exactly one of your ten DNS lookups.
Setup
How to add the SPF record for Google Workspace
Look before you add: if the domain already has a TXT record starting v=spf1, edit it instead of creating a second one.
Step 1
Check
Look for an existing TXT record starting with v=spf1.
Step 2
Add or edit
One TXT record at host @ (or the subdomain you send from).
Step 3
Paste
Add include:_spf.google.com before the all at the end.
Step 4
Verify
Send to Gmail and look for spf=pass in Show original.
| Field | Value |
|---|---|
| Type | TXT |
| Host / Name | @ |
| Value | v=spf1 include:_spf.google.com ~all |
| TTL | Your host's default |
Some hosts want the value wrapped in quotes; most add them for you. Menu paths for GoDaddy, Cloudflare, Namecheap and Squarespace are in our DKIM setup guide; use host @ instead of the DKIM host. Each subdomain that sends mail needs its own SPF record.
Other senders
Combining Google Workspace with other senders
Every service that sends from its own servers using your domain needs to be in the one record. Add its include before ~all.
| Service | Include | DNS lookups | Note |
|---|---|---|---|
| Google Workspace | include:_spf.google.com | 1 | The base record. |
| Microsoft 365 | include:spf.protection.outlook.com | 1 | Only if some mailboxes live in Microsoft 365. |
| SendGrid | include:sendgrid.net | 2 | With domain authentication, SendGrid can manage SPF on a subdomain instead. |
| Mailgun | include:mailgun.org | 5 | Nested includes make it expensive. |
| Amazon SES | include:amazonses.com | 1 | Published on your custom MAIL FROM subdomain, not the root. |
| Zoho Mail | include:zohomail.com | 2 | If you also use Zoho products, Zoho suggests one.zoho.com instead. |
Google Workspace + Microsoft 365
v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~allTwo SPF records means no SPF at all
Some services send with their own Return-Path domain, so SPF is checked against their domain rather than yours. Check each service's documentation before adding an include you may not need.
Qualifiers
~all vs -all: the end of your SPF record
The last part tells receivers how to treat servers you didn't list. Google recommends ~all for Google Workspace.
| Ending | Result for unlisted servers | Use it? |
|---|---|---|
~all | Soft fail: accepted but marked suspicious. | Yes. Google's recommended default. |
-all | Fail: receivers may reject the message. | Only once you're sure every sender is listed. |
?all | Neutral: no statement either way. | No. It protects nothing. |
+all | Pass: any server on the internet may send as you. | Never. |
SPF on its own doesn't protect the From address people see. That is DMARC's job; see SPF vs DKIM vs DMARC for how the three fit together.
Mailboxes with SPF, DKIM and DMARC already set
Limits
Staying under the 10-lookup limit
RFC 7208 caps an SPF check at 10 DNS lookups. Go over and SPF returns a permanent error, even for servers you did authorize.
- What counts: every
include,a,mx,ptr,existsandredirect, including the ones nested inside records you include. - What's free:
ip4,ip6andall. - Empty answers count too: more than two lookups that return nothing should also end in a permanent error, so remove includes for services you no longer use.
- Running out? Move bulk or marketing tools to a subdomain with its own SPF record.
Count your lookups with the free SPF record checker, which also tests DKIM, DMARC and MX.
Sources: Google: set up SPF · Google: about SPF records · RFC 7208 (SPF) · Microsoft: set up SPF · SendGrid: SPF · Mailgun: domain verification · Amazon SES: custom MAIL FROM · Zoho Mail: SPF
Get a free DNS audit
Tell us where to send it. We'll reply with mailbox, domain and DNS recommendations for your sending volume — or start right away and have mailboxes live in minutes.
Where should we send it?
Or see pricing →Frequently asked questions
What is the SPF record for Google Workspace?
v=spf1 include:_spf.google.com ~all, added as a TXT record at your root domain (host @). It authorizes Google's mail servers to send for your domain and soft-fails everything else.
Should I use ~all or -all with Google Workspace?
Google recommends ~all. With -all, receivers may reject mail from any server you forgot to list, so a missing include can send legitimate mail to spam or bounce it. Once DMARC is enforcing, it decides what happens to failures anyway.
How do I add Microsoft 365 or another sender to my Google SPF record?
Add its include to the same record, before ~all: v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all. Never publish a second v=spf1 record; two SPF records make SPF fail with a permanent error.
How many DNS lookups does include:_spf.google.com use?
One. When we checked in October 2026, _spf.google.com listed Google's IP ranges directly with no nested includes, so it uses 1 of your 10 allowed lookups.
Do Instantly or Smartlead need their own SPF include?
Not when they send through your Google Workspace mailbox. The mail still leaves from Google's servers, which include:_spf.google.com already covers. Only services that send from their own servers need an include.
How long does a new SPF record take to work?
Google says it can take up to 48 hours for SPF authentication to start working after you add the record, though most DNS hosts publish changes much faster.