SPF Record Examples for Google Workspace and Microsoft 365 With a Sending Tool

One domain gets one SPF record, so when you add a sending tool you add its include to your existing record instead of creating a second one. For Google Workspace the record is v=spf1 include:_spf.google.com ~all. For Microsoft 365 it is v=spf1 include:spf.protection.outlook.com -all. Add a tool's include before the all term.

Examples

The last address is a documentation address that belongs to nobody. Use your own. ip4 and ip6 terms cost no DNS lookup, which makes them the tidy choice for servers you control.

The ending: ~all or -all

~all (soft fail) tells receivers that mail from other sources is probably not yours. -all (hard fail) says it is not yours. Many teams start with ~all while they confirm every sender is listed, and move to -all later. A +all ending authorises the whole internet and should never be used. With DMARC in place, receivers lean on the DMARC policy, so the difference is smaller than it looks.

Add a tool in four steps

1. Copy the include value from the tool's domain set-up screen.
2. Edit the existing SPF record. Do not add a new TXT record starting v=spf1.
3. Put the new include before the final all term.
4. Run an SPF check and look at the lookup count. If it is over 10, see the permerror guide.

For cold email, use a separate domain

Your main domain already carries Google Workspace or Microsoft 365, invoices and newsletters. Cold outreach is better kept on a separate sending domain with its own short SPF record, so one set of lookups and one reputation do not affect the other.