Setup Guides · Google Workspace
Google Workspace SPF Setup: One Record, _spf.google.com, and the 10-Lookup Trap
SPF for Google Workspace is a single DNS record - v=spf1 include:_spf.google.com ~all - but the details are where it breaks: a second SPF record, the ten-DNS-lookup limit (Google flattened its include so it now costs just one lookup, though most guides still say four), and the moment you forget a third-party sender. This guide is the exact record, how to add other senders safely, when to switch to -all, and the five failures we keep finding.
Last updated 30 August 2026 · applies to all Google Workspace domains
What SPF does (and does not) do
SPF publishes the list of servers allowed to send mail for your domain. A receiver checks the sending server against that list and records a pass or fail. It is one of the two authentication checks DMARC relies on - but SPF alone has two limits worth knowing before you start: it authenticates the envelope (Return-Path) domain, not your visible From, and it breaks whenever mail is forwarded or sent through a Google Group. That is why SPF is necessary but not sufficient: real protection needs SPF, DKIM, and DMARC together.
What you need
- Access to your domain's public DNS (registrar or DNS host).
- A list of every service that sends mail as your domain - Google Workspace plus any marketing, invoicing, CRM or help-desk tools.
- About 10 minutes, plus DNS propagation time.
The setup, step by step
1 Check whether you already have an SPF record
Look up your domain's TXT records for one starting with v=spf1. If you added Workspace through a registrar setup wizard, one may already exist. You are editing that single record - never creating a second one. The fast way: run your domain through the SPF checker, which shows the current record and counts its DNS lookups.
2 Publish the Google Workspace record
Set a single TXT record at your domain root (@):
Name: @ (your domain root) Type: TXT Value: v=spf1 include:_spf.google.com ~all
The include:_spf.google.com is the only mechanism Workspace needs - it expands to Google's full sending range and stays current as Google rotates IPs. Google documents ~all; you can tighten it to -all once your senders are confirmed (step 5).
3 Add any other senders - before the all
Every additional service that sends as your domain needs its own mechanism, placed before the all:
v=spf1 include:_spf.google.com include:_spf.example-marketing.com ~all
Add the exact include each vendor documents. Do not add servers you do not recognise, and never use +all (which authorises the whole internet).
4 Stay under the 10-lookup limit
SPF permits at most ten DNS lookups when a record is evaluated. include:_spf.google.com now costs exactly one lookup - Google collapsed it into a single flat ip4/ip6 list, so it no longer nests _netblocks, _netblocks2 and _netblocks3 (most guides on the internet still say four; resolve it yourself and you will see one). That leaves more headroom than the old advice implies, but the limit still bites: stack a few third-party includes and you can quietly cross ten - a permerror that fails SPF for all your mail, Google's included. If the checker shows you near the limit, consolidate vendors or use an SPF-flattening service. DKIM alignment does not count against this limit, which is another reason to lean on DKIM.
5 Tighten to -all and verify
Once the reports and checker confirm every legitimate sender is listed, change ~all to -all for a hard fail. Then send one email to Postbox Mailtester - it confirms SPF passes, aligns, and stays under the lookup limit, and checks your Gmail sender-requirement compliance.
The five failures we keep finding
1. Two SPF records
A domain may have only one v=spf1 record. A second one (often left behind by an old provider) is a permerror and SPF fails for everyone. Merge every sender into a single record.
2. More than ten DNS lookups
The most common silent failure. Google's own include is cheap now - one lookup since it flattened - but a handful of third-party includes (a CRM, a helpdesk, a marketing platform, each spending several lookups of its own) still tips you over ten and permerrors; Google's own mail then fails SPF even though the include is correct. Count with the checker and consolidate.
3. A forgotten third-party sender
Marketing, invoicing or ticketing tools that send as your domain but are not in the record fail SPF - and once you enforce DMARC, get quarantined. List every sender before you tighten all.
4. Using +all, or never leaving ~all
~all is a safe starting point that Google documents, but it is not a destination - it tells receivers "probably not us, but deliver anyway". +all is worse: it authorises the entire internet. Finish at -all.
5. Trusting SPF to survive forwarding and Groups
SPF breaks whenever a message is forwarded or delivered through a Google Group, so an SPF-only domain fails DMARC on that mail. This is why you also need aligned DKIM and a monitored DMARC policy - SPF is one leg of three.
Verify it end to end
- Check the record + lookups: the SPF checker validates syntax, counts DNS lookups, and flags a second record or a permerror.
- Confirm on a real message: send one email to Postbox Mailtester - it reports SPF, alignment, and your Gmail sender-requirement compliance in one score.
Frequently asked questions
What is the SPF record for Google Workspace?
v=spf1 include:_spf.google.com ~all, published as one TXT record at your domain root. Add any other sender's include before the all, and move to -all once confirmed.
Why the include and not the IPs?
_spf.google.com is a single flat list of Google's current ranges (as of 2026 - Google collapsed the old _netblocks includes) and stays current as Google rotates IPs. Hard-coding IPs breaks the moment they change.
What is the 10-lookup limit?
SPF allows at most ten DNS lookups. Google's include now costs just one (it flattened - many guides still say four), but a few more third-party includes can still exceed ten, which permerrors and fails SPF for all your mail. Consolidate to stay under it.
~all or -all?
Google documents ~all, safe while you confirm senders. -all is the stronger end state - switch once every legitimate sender is listed.
Related: Google Workspace DKIM · Google Workspace DMARC · Microsoft 365 SPF · Zoho Mail SPF. The SPF standard is RFC 7208.
Not sure your SPF is under the limit?