How to Add an SPF Record in OVH

OVH (now OVHcloud) is one of Europe's largest hosting and domain providers, serving millions of domains worldwide. If your domain is registered with OVH or you're using their DNS hosting, you'll manage SPF records through the Web Cloud control panel. OVH has a unique feature worth knowing about: they offer a dedicated "SPF" record type in their DNS editor, but using a standard TXT record is more reliable and widely compatible.

This guide walks you through adding, editing, and verifying an SPF record in OVH's DNS Zone manager.

Why SPF Matters for OVH Domains

Whether you're using OVH's own email hosting, Google Workspace, Microsoft 365, or a transactional email service, your domain needs an SPF record to tell receiving servers who's authorized to send email on your behalf. Without SPF, your messages are more likely to be flagged as spam or rejected outright.

An SPF record is a simple TXT record in your DNS zone, as defined in RFC 7208. It takes just a few minutes to create, and it's the foundation of email authentication for your domain.

Step-by-Step: Adding an SPF Record in OVH

A Note on the Subdomain Field

In OVH's DNS Zone editor, the Subdomain field determines where the record is applied. For your root domain's SPF record, leave this field empty. OVH automatically associates records with no subdomain to the root domain. If you enter a subdomain name, the SPF record will only apply to that subdomain -- not your main domain.

SPF Record Examples for OVH

Here are ready-to-use SPF records for common email setups. Paste these into the Target field.

Google Workspace Only

Use the _spf.google.com include for Google Workspace:

v=spf1 include:_spf.google.com -all

Microsoft 365 Only

Use the spf.protection.outlook.com include for Microsoft 365:

v=spf1 include:spf.protection.outlook.com -all

OVH Email + Google Workspace

v=spf1 include:mx.ovh.com include:_spf.google.com -all

If you use OVH's own email hosting alongside Google Workspace, include both. The mx.ovh.com mechanism authorizes OVH's mail servers.

Google Workspace + SendGrid

v=spf1 include:_spf.google.com include:sendgrid.net -all

Microsoft 365 + Mailchimp

v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net -all

Common OVH SPF Mistakes

Using the SPF Record Type Instead of TXT

OVH's DNS editor offers a dedicated "SPF" record type. While it functions similarly, the SPF DNS type was deprecated in 2014. Some resolvers may not query for it, meaning your SPF record could go undetected. Always use a TXT record type for SPF. If you already have an SPF-type record, consider deleting it and recreating it as a TXT record.

Creating Duplicate SPF Records

If OVH created a default SPF record for their email hosting and you add a second one for Google Workspace, you'll have two SPF records. This causes a permerror that breaks SPF for every email. Always check for existing records and edit rather than adding a new one.

Entering a Subdomain When You Want Root

Leaving the Subdomain field empty applies the record to your root domain. If you accidentally type something in this field, the SPF record will only cover that subdomain. Double-check that the Subdomain field is blank for your main SPF record.

Not Removing OVH Mechanisms After Migration

If you've moved email away from OVH's hosting to Google Workspace or Microsoft 365, remove the OVH-specific include (include:mx.ovh.com) from your SPF record. Keeping it wastes a DNS lookup and can cause confusion during troubleshooting.

Editing an Existing SPF Record in OVH

Verifying Your SPF Record

After adding or editing your SPF record in OVH, verify it's correct and published.

• SPF Record Check -- Go to spfrecordcheck.com and enter your domain. It validates syntax, counts DNS lookups, and flags errors.
• Send a test email -- Send a message from each service in your SPF record and check the email headers for spf=pass in the Authentication-Results.
• Command line -- Run dig TXT yourdomain.com +short or nslookup -type=TXT yourdomain.com to see your published TXT records.

Complete Your Email Authentication

SPF is the first step. For comprehensive email authentication, you need all three protocols:

• DKIM adds a cryptographic signature to outgoing emails. Use DKIM Creator to generate your DKIM keys and add the TXT records in OVH's DNS Zone.
• DMARC ties SPF and DKIM together and defines a policy for authentication failures. Use DMARC Creator to build your DMARC record.

Adding DKIM and DMARC records in OVH follows the same process as SPF -- create TXT records with the appropriate names and values in the DNS Zone editor.