DNS Record Explainer

v=spf1
SPF version identifier. Always v=spf1 for all SPF records; don't change this.

include:_spf.google.com
Pulls in Google's SPF authorizations (Gmail, Workspace mail servers, etc.). The resolver does a DNS lookup on _spf.google.com and processes those SPF rules as if they were inline. Useful for outsourced email providers.

include:mailgun.org
Same mechanism as Google—authorizes Mailgun's mail servers to send on your domain's behalf. Typically used if you're sending transactional email through Mailgun's API/SMTP.

~all
Soft fail. Servers that don't match any prior rule are marked as "softfail." This is a non-blocking rejection—receivers can still accept the mail but flag it or lower trust. Common when you're still testing or migrating email infrastructure. The alternative is -all (hard fail), which explicitly rejects non-matching senders.

• Check that both _spf.google.com and mailgun.org actually exist and resolve. If either is dead or returns no SPF record, those includes will fail silently, and legitimate mail may bounce.
• Verify your SPF record doesn't exceed 10 DNS lookups. Each include counts as a lookup; if you have too many includes, mail may fail at validation time. Your current record is safe (2 includes), but this matters as you add more.
• ~all is permissive. If you control all mail for this domain and only these two providers send from it, consider -all (hard fail) for stronger DMARC/DKIM alignment and abuse prevention.
• Record length: SPF records must fit in a single 255-byte DNS TXT record (or use multiple strings concatenated). This one is short enough.

This record tells receivers which IP ranges and mail servers are authorized to send email for your domain. Without it (or with a weak one like ~all), your mail gets lower trust scores, may land in spam, or fail SPF checks outright. It's foundational for DMARC enforcement. If Google or Mailgun change their infrastructure, their SPF records update automatically—your include just points to their canonical list, so you don't have to manually edit yours.

→ /tools/spf-checker run the live checker on a real domain → /blog/spf-10-dns-lookup-limit