SPF Records by Email Provider: Complete Reference

Every email service your business uses -- Google Workspace for staff email, SendGrid for password resets, Mailchimp for newsletters -- sends messages through its own servers. Your domain's SPF record is the only way to tell the rest of the internet that those servers are authorized to send on your behalf. If a provider is missing from your record, email sent through that provider fails SPF checks. If you use the wrong include value -- even a small typo -- the same thing happens. Messages bounce, land in spam, or get silently dropped.

This page is your single reference for the correct SPF include value for every major email provider. Bookmark it, come back when you add a new service, and use it alongside the free SPF Creator tool to generate your record automatically.

How Provider SPF Includes Work

When you send email through a service like Microsoft 365 or Amazon SES, the message leaves from that provider's mail servers -- not from a server you own. The receiving mail server sees the sending IP, looks up your domain's SPF record, and checks whether that IP is authorized.

Each provider publishes their authorized sending IPs behind an SPF include domain. For example, when you add include:_spf.google.com to your record, you're telling receivers: "any server that Google authorizes for sending is also authorized for my domain." Behind the scenes, that single include can resolve into dozens of IP ranges through nested lookups -- but you only need to add the one include value.

The critical point is that every provider has a different include domain. Google uses _spf.google.com, Microsoft uses spf.protection.outlook.com, and SendGrid uses sendgrid.net. There is no universal value. Using the wrong domain -- or a value you found in an outdated blog post -- means the authorization chain breaks and SPF fails for every message that provider sends.

This is why a reliable, up-to-date reference matters. The table below lists the correct include value for 19 providers, sourced from each provider's official documentation.

Quick Reference: SPF Include Values

Here's every major email provider and the include value you need in your SPF record.

Top 10 Providers: Details and Setup Guides

The table above gives you every include value at a glance. Below, you'll find additional context for the ten most widely used providers -- what each service is typically used for, and a link to the dedicated setup guide.

Google Workspace

Google Workspace (formerly G Suite) is the most common business email platform. It handles employee inboxes, shared mailboxes, and Google Groups. The SPF include value is include:_spf.google.com. This covers all sending infrastructure for Gmail-hosted domains, including messages sent through the Gmail web interface, mobile apps, and SMTP relay.

Full guide: SPF for Google Workspace

Microsoft 365

Microsoft 365 (Exchange Online) is the other dominant business email platform. It powers Outlook-hosted domains, shared mailboxes, and Microsoft Teams email notifications. The include value is include:spf.protection.outlook.com. If you migrated from on-premises Exchange, make sure your old IP-based SPF entries are removed once the migration is complete.

Full guide: SPF for Microsoft 365

SendGrid

SendGrid is one of the most popular transactional email services, used for password resets, order confirmations, and system notifications. The include value is include:sendgrid.net. SendGrid also supports custom return-path domains for stricter DMARC alignment, which is worth configuring if deliverability is critical to your application.

Full guide: SPF for Transactional Email Services

Mailchimp (Mandrill)

Mailchimp uses Mandrill as its sending infrastructure for authenticated email. The include value is include:spf.mandrillapp.com -- not mailchimp.com, which is a common mistake. You'll need to verify your sending domain in Mailchimp's settings before email authentication takes effect.

Full guide: SPF Record for Mailchimp

Amazon SES

Amazon SES (Simple Email Service) is a developer-focused sending service commonly used by SaaS applications and startups. The include value is include:amazonses.com. SES operates in multiple AWS regions, but the single include value covers all of them. If you also use Amazon WorkMail for business email, that uses the same include.

Full guide: SPF Record for Amazon SES

Mailgun

Mailgun is a transactional and bulk email API popular with developers. The include value is include:mailgun.org. Mailgun also supports dedicated IPs for high-volume senders, but the include value remains the same regardless of whether you use shared or dedicated infrastructure.

Full guide: SPF Record for Mailgun

Salesforce

Salesforce sends email from multiple contexts -- workflow alerts, case notifications, and Salesforce Marketing Cloud campaigns. The include value for the core platform is include:_spf.salesforce.com. If you also use Marketing Cloud, check whether your account requires additional include values, as Marketing Cloud can use different sending infrastructure depending on your configuration.

Full guide: SPF for Salesforce

HubSpot

HubSpot handles marketing emails, sales sequences, and CRM-triggered messages. The include value is include:spf.hubspot.com. HubSpot requires domain authentication through their settings panel before emails are sent from your custom domain rather than HubSpot's default sending domain.

Full guide: SPF Record for HubSpot

Klaviyo

Klaviyo is an email and SMS marketing platform popular with e-commerce businesses. The include value is include:spf.klaviyo.com. Klaviyo is frequently paired with Shopify, so if you use both, make sure both includes are present in your SPF record.

Full guide: SPF Record for Klaviyo

Mimecast

Mimecast is an email security gateway that filters inbound and outbound mail. Because it sits between your mail server and the internet, outbound messages are sent from Mimecast's infrastructure. The include value is include:_netblocks.mimecast.com. Mimecast's include adds a significant number of IP ranges, so factor this into your DNS lookup budget.

Full guide: SPF Record for Mimecast

Common Real-World Combinations

Most businesses don't use just one email service. Here are four typical SPF records based on common business setups, along with how many DNS lookups each combination requires. The lookup counts are approximate -- they can vary as providers update their infrastructure.

Notice that even with three or four providers, lookup counts climb quickly toward the limit of 10. The enterprise combination with Mimecast is already at seven lookups. Adding one more provider to that record could push you past the limit.

How to Combine Multiple Providers

You can only have one SPF record per domain. If you use multiple email services, all of their include values go into that single record. Creating a second SPF TXT record doesn't add to the first -- it breaks both of them, because receivers don't know which one to use.

Here's the step-by-step process for building a combined SPF record:

Step 1: List every service that sends email as your domain. This includes your primary email platform (Google Workspace, Microsoft 365), any transactional email service (SendGrid, Postmark), any marketing platform (Mailchimp, Klaviyo), and any other tool that sends email on your behalf (Zendesk, Salesforce, Shopify).

Step 2: Find the include value for each service. Use the quick reference table above. Always verify against the provider's official documentation, since include values can change.

Step 3: Build the record. Start with v=spf1, add one include: mechanism for each service, and end with -all to reject all unauthorized senders. For example:

v=spf1 include:_spf.google.com include:sendgrid.net include:spf.mandrillapp.com -all

Step 4: Check your lookup count. Before publishing, count the total DNS lookups your record will require. See the section below for details on how lookups add up.

Step 5: Publish the record. Add it as a single TXT record in your DNS provider. For step-by-step instructions specific to your DNS host, see SPF Records by DNS Provider.

The 10 DNS Lookup Limit

The SPF specification (RFC 7208, section 4.6.4) limits SPF evaluation to 10 DNS lookups. Every include:, a, mx, and redirect mechanism in your record triggers at least one lookup. The ip4: and ip6: mechanisms do not count -- they're evaluated directly without a DNS query.

The tricky part is that includes are recursive. When you add include:_spf.google.com, that's one lookup. But Google's SPF record itself contains additional includes that trigger more lookups. A single provider include often costs two to four lookups once the nested chain is resolved.

Here's how the most common providers add up:

These counts can change as providers update their infrastructure. Always verify your total by testing your record with an SPF lookup checker.

If you exceed 10 lookups, the entire SPF evaluation returns a permerror result -- which most receivers treat the same as a fail. Your SPF record effectively stops working for every provider, not just the ones that pushed you over the limit.

When you're running close to the limit, you have a few options:

• Remove services you no longer use. Audit your includes and drop any providers you've stopped using. Old marketing tools and retired help desks are common culprits.
• Use SPF flattening to replace include mechanisms with the resolved IP addresses. This eliminates the nested lookups but requires ongoing maintenance, since provider IPs change. Read our SPF flattening guide for details.
• Consolidate services where possible. If you're using two transactional email services, consider migrating to one.

For a detailed walkthrough of the lookup limit and strategies for managing it, read Understanding the SPF 10 DNS Lookup Limit.

Verify Your Record and Complete Your Setup

After adding your provider includes, verify that everything is working correctly. Use the SPF Record Checker to confirm:

• Your record is syntactically valid
• Your total lookup count is under the limit of 10
• All your providers are properly included and resolving
• You don't have multiple SPF records on your domain

SPF is only one piece of email authentication. For full protection, you also need DKIM (which cryptographically signs your messages) and DMARC (which tells receivers what to do when SPF or DKIM fails). Each email provider you use should have DKIM configured as well -- not just SPF. Together, the three protocols protect your domain from spoofing and maximize your deliverability. For a complete walkthrough of all three, read the SPF, DKIM, and DMARC Setup Guide.

Monitor Your SPF Record

Provider include values can change without notice, and adding a new service without updating your SPF record is one of the most common causes of deliverability problems. Automated monitoring catches these issues before they affect your email.