DNS Record Explainer

v=spf1 — SPF version identifier. Always v=spf1; nothing else is valid.

include:_spf.google.com — Pull in Google's SPF record (they maintain it; you're delegating to their servers). This covers Gmail, Google Workspace mail, etc.

include:mailgun.org — Same thing for Mailgun's infrastructure. Mailgun is a mail delivery service; this lets their servers send mail on your domain's behalf.

~all — Softfail on everything else. Means "any server not covered by the includes above will fail the SPF check, but don't reject the mail immediately." The ~ is a soft qualifier; use - (hardfail) only if you're certain you've listed all legitimate senders.

• DNS lookup limit: SPF can trigger up to 10 DNS queries per check. Your record has 2 includes, so you're using 2 + however many Google and Mailgun's own SPF records reference. Check those in case you're near the limit (common problem as you add more senders).

• Softfail vs hardfail: ~all is lenient. Okay if this is a new domain or you're still adding senders. If you're confident no other system sends mail from this domain, switch to -all (hardfail) for stronger enforcement.

• Google and Mailgun IPs change. Both use includes specifically so you don't have to maintain hardcoded IP lists. That's the point — the includes stay current.

SPF tells receiving mail servers "these are the only systems allowed to send mail from @yourdomain." Without it, anyone can spoof your domain (or at least, receivers won't have a way to verify you didn't authorize them). Gmail, Outlook, and most major providers check SPF. Missing or weak SPF hurts deliverability and lets attackers impersonate you. Pair this with DKIM and DMARC for full authentication.

→ /tools/spf-checker run the live checker on a real domain → /blog/spf-10-dns-lookup-limit