# SPF Record Examples for Google Workspace and Microsoft 365 With a Sending Tool

URL: https://warmerly.com/blog/spf-record-examples-google-workspace-microsoft-365-sending-tool
Published: 2026-10-14
Reading time: 5 minutes
Tags: DNS, Authentication, Setup

> Working SPF record examples for Google Workspace and Microsoft 365, how to add a sending tool without a second record, and how to keep under 10 lookups.

One domain gets one SPF record, so when you add a sending tool you add its include to your existing record instead of creating a second one. For Google Workspace the record is v=spf1 include:_spf.google.com ~all. For Microsoft 365 it is v=spf1 include:spf.protection.outlook.com -all. Add a tool's include before the all term.

> **How this was checked**: The two provider includes are the ones Google and Microsoft publish for their mail systems. The tool include below is a placeholder, because every tool publishes its own value in its set-up screen; copy that, not ours. The lookup counts depend on what providers publish at the time, so always check the total with a checker after you change a record.

## Examples

**SPF records by set-up (example values; confirm each include with the provider)**
| Set-up | Record |
| --- | --- |
| Google Workspace only | v=spf1 include:_spf.google.com ~all |
| Microsoft 365 only | v=spf1 include:spf.protection.outlook.com -all |
| Google Workspace plus one tool | v=spf1 include:_spf.google.com include:_spf.tool.example ~all |
| A server you run yourself | v=spf1 ip4:203.0.113.10 ~all |

The last address is a documentation address that belongs to nobody. Use your own. ip4 and ip6 terms cost no DNS lookup, which makes them the tidy choice for servers you control.

## The ending: ~all or -all

~all (soft fail) tells receivers that mail from other sources is probably not yours. -all (hard fail) says it is not yours. Many teams start with ~all while they confirm every sender is listed, and move to -all later. A +all ending authorises the whole internet and should never be used. With DMARC in place, receivers lean on the DMARC policy, so the difference is smaller than it looks.

## Add a tool in four steps

1. Copy the include value from the tool's domain set-up screen.
2. Edit the existing SPF record. Do not add a new TXT record starting v=spf1.
3. Put the new include before the final all term.
4. Run an SPF check and look at the lookup count. If it is over 10, see the permerror guide.

## For cold email, use a separate domain

Your main domain already carries Google Workspace or Microsoft 365, invoices and newsletters. Cold outreach is better kept on a separate sending domain with its own short SPF record, so one set of lookups and one reputation do not affect the other.

**Check your record**
- [Free SPF checker](https://warmerly.com/spf-checker)
- [SPF permerror: too many DNS lookups](https://warmerly.com/blog/spf-permerror-too-many-dns-lookups)
- [SPF, DKIM and DMARC for cold email](https://warmerly.com/blog/spf-dkim-dmarc-cold-email)

---
Source: https://warmerly.com/blog/spf-record-examples-google-workspace-microsoft-365-sending-tool
Full content index: https://warmerly.com/llms-full.txt
Site index: https://warmerly.com/llms.txt