Email is one of the most critical communication tools for businesses. However, ensuring that your email reaches its intended recipient’s inbox and isn’t flagged as spam or phishing is a significant challenge. If your business uses Google Workspace for email, it has several options to validate the sending email server, and the Sender Policy Framework (SPF) record is the most important one. It is used to notify the recipient’s email server that Google is authorized to send email messages on behalf of your domain.
In this article, we’ll explain what an SPF record is, why it’s important, and provide step-by-step instructions for configuring it for Google Workspace.
SPF is a Domain Name System (DNS) record that specifies which mail servers are authorized to send email on behalf of your domain. Essentially, an SPF record tells the recipient’s email server, “Here is a list of servers that are allowed to send email using our domain.”
An illustration of how an SPF record authorizes email servers to send messages on behalf of a domain, helping prevent spoofing and improve email deliverability.
When an email is received, the recipient’s email server checks the SPF record to verify whether the email came from an authorized server. If the server isn’t listed, the email might (and probably would) be marked as spam or rejected altogether.
Emails are a common entry point for various types of cyberattacks. There are different types of cyberattacks that target email users: spam, phishing, malware, spoofing, etc. Email spoofing is a cyberattack where the attacker forges the sender's email address to make it appear as though the email comes from a trusted source, such as a company, colleague, or friend. The goal of email spoofing is often to trick the recipient into taking a specific action, such as:
An email delivery failure notification due to an unauthorized sending server in Google Workspace. This occurs when the sender's domain lacks a properly configured SPF record, causing the recipient's server to reject or mark the email as spam.
The fundamental way to prevent spoofing of your domain is to create SPF records in the external DNS zone.
One might ask, “SPF records protect the recipients of emails we send from spoofing, not the users within our own domain - so why should we care?” The answer lies in the primary purpose of SPF: improving the deliverability of your emails. By signaling to recipient mail servers which servers are authorized to send emails on behalf of your domain, SPF reduces the chances of legitimate messages being flagged as spam or rejected. Furthermore, it helps to protect your organization’s reputation by preventing your domain from being associated with spam or malicious activity, thereby maintaining credibility with recipients and email service providers.
To create SPF for your email domain, you need to create a TXT record in the external DNS zone. The record contains two fields – domain name and value. The domain name field should specify the domain that sends the messages. If you don’t use subdomains, there is no need to specify anything here. Some domain registrars require using the “@” symbol in this case. If you use subdomain – specify it here.
Record value is the text string that defines the policy itself, it contains several elements, each must be separated by space:
Your record should look something like this in the end:
This image displays the setup of an SPF record in a domain registrar’s DNS management panel. The record authorizes Google’s mail servers to send emails on behalf of the domain, improving email deliverability and security.
Before configuring your SPF record, gather information about all the services that will send emails to external recipients on behalf of your domain. Each service must be included in the lookup mechanisms.
In the simplest case, where only Google Workspace will be used for sending emails, the SPF record should look like this:
v=spf1 include:_spf.google.com ~all
If you use multiple services - for example, Google Workspace for corporate emails and a third-party provider (such as Mailchimp or SendGrid) for marketing campaigns - both must be included in the SPF record. The following example authorizes both Google Workspace and Mailchimp:
v=spf1 include:_spf.google.com include:servers.mcsv.net ~all
For scenarios where you have an on-premises SMTP relay service, you need to include the IP addresses of your data center in the SPF record. For example:
v=spf1 include:_spf.google.com ip4:193.22.100.7/30 ~all
An SPF record example showing sender authorization for both Google Workspace and an on-premises email server, ensuring proper email delivery and security.
By ensuring all relevant services are included, you help prevent unauthorized senders from misusing your domain while maintaining email deliverability.
Once you’ve defined the content of your SPF record, you can create it in your external DNS zone. This is typically managed through your domain registrar’s web interface. If you’re unsure where your domain is registered, refer to the Identify your domain registrar help article for guidance.
The steps to create the SPF record may vary depending on the DNS management tools provided by your registrar, but they generally follow this process:
When configuring an SPF record for your Google Workspace email infrastructure, follow these best practices:
If you are experiencing email deliverability issues, one possible cause could be a misconfigured SPF record. Common signs of misconfiguration include:
To troubleshoot SPF-related problems, follow these steps:
Configuring an SPF record for Google Workspace is a simple yet critical step in protecting your business’s email communications. It protects your domain against spoofing, enhances email deliverability, and preserves your brand’s reputation.Besides SPF, there are many other aspects that affect the security of your SaaS infrastructure. To get full visibility of the configuration and improve your organization’s security posture, you may need additional tools, such as Reco’s Posture Management solution, that will help reduce administrative overhead and compliance risks. Reach out for a demo of Reco today.
