1. Which of these send email for this domain?

Check every service that sends mail using this domain's address - your inbox, your ESP, your CRM. Missing one means that sender's mail can fail SPF.

Google WorkspaceCovers Gmail/Google Workspace sending. Google's own include chains to 3 more lookups internally, so this one line already spends 4 of your 10.

Microsoft 365Covers Exchange Online / Microsoft 365 mailboxes. Using outlook.com, microsoft.com or office365.com instead is a common mistake - none of those work.

Amazon SES (custom MAIL FROM only)Only needed if you configured a custom MAIL FROM domain in SES - the default MAIL FROM already authenticates automatically without this.

SendGridCovers SendGrid-sent mail. SendGrid's regional sending infrastructure chains to about 5 lookups total.

MailgunCovers Mailgun-sent transactional or marketing mail.

PostmarkCovers Postmark-sent transactional mail. spf.mtasv.net is correct, not a typo.

Zoho MailThe correct value is zohomail.com, not zoho.com - a common mistake that silently fails.

ActiveCampaign (manual setup only)Only needed if you chose ActiveCampaign's manual SPF setup. If you used their CNAME-based automatic sending-domain setup instead, skip this - it's already covered.

MailchimpMailchimp sends from its own return-path domain, so adding it here doesn't help SPF alignment - it would just waste a lookup. Rely on DKIM (Mailchimp sets this up automatically) and DMARC instead.

KlaviyoWith a branded sending domain, Klaviyo's own CNAME records handle SPF and DKIM automatically - no manual SPF entry needed here.

Constant ContactConstant Contact's envelope-from never matches your domain, so an SPF include here can't achieve alignment - it only wastes a lookup. Rely on DKIM and DMARC instead.

HubSpotHubSpot's SPF include is account-specific - copy the exact value from your HubSpot email authentication settings and add it as a custom mechanism below.

2. Anything else? (optional)

One mechanism per line, e.g. include:mail.example.com or ip4:203.0.113.10 for a server you send from directly.

3. What happens to mail that doesn’t match?

~all (soft fail) - recommendedUnrecognized senders are flagged but usually still delivered. Safer while you're still finding all your senders.

-all (hard fail)Unrecognized senders are rejected outright. Only switch to this once you're confident every real sender is listed above.

?all (neutral)Says nothing about unrecognized senders. Rarely useful - mainly for testing a domain that doesn't send mail yet.

SPF Record Generator

1. Which of these send email for this domain?

2. Anything else? (optional)

3. What happens to mail that doesn’t match?

Your SPF record