SPF (Sender Policy Framework) is a DNS record that lists the servers allowed to send email for your domain. When your Mautic email arrives, the receiving mail server checks that list, and if the server that sent it isn't on there, your email looks suspicious. It's usually the first thing to get right, and the thing we see broken most often in our community!
This guide walks you through setting it up for the domain you send Mautic email from. If you want the full technical detail, SPF is defined in RFC 7208.
You'll need these.
Mautic doesn't send email itself. It hands each message to the email service set up under Settings > Configuration > Email Settings, and it's that service whose servers need to be in your SPF record.
Make a list of everything that sends email using your domain, not just Mautic. Think about your staff mailboxes (Google Workspace or Microsoft 365), your CRM, helpdesk, invoicing tool and website contact forms. Anything you leave off may start failing.
Every email service publishes the bit you need to add, usually an include. Look in their domain authentication or sender setup pages. Some examples look like this.
include:amazonses.com
include:sendgrid.net
include:mailgun.org
Many services also offer a custom MAIL FROM or custom return path domain (something like bounce.yourdomain.com). Set this up if you can, because it means SPF passes on your own domain, which you'll need for DMARC later.
You can only have one SPF record per domain. Two records break SPF completely. Look in your DNS for a TXT record on your domain that starts with v=spf1.
If you don't have one yet, create a TXT record on your domain (the host or name is usually @) with a value like this.
v=spf1 include:_spf.google.com include:amazonses.com ~all
If you already have one, add your email service's include to the existing record, before the ~all or -all at the end. Don't create a second record.
The ending matters.
~all says anything not listed probably isn't allowed (known as a soft fail). This is the safest choice for most senders, especially once you have DMARC set up, because DMARC then decides what happens to failing email.-all says anything not listed definitely isn't allowed (known as a hard fail). It's stricter, but some mail servers reject on it before checking DKIM and DMARC, which can block legitimate forwarded email. Use it with care.+all, which lets the whole internet send as you!For a closer look at the results, see How to check your email authentication in message headers.
"Too many DNS lookups" or permerror. SPF allows a maximum of ten lookups, and every include counts, including the includes inside other includes (Kitterman, 2014). Remove services you no longer use, or move some of them onto a subdomain such as news.yourdomain.com, which gets its own SPF record.
SPF passes, but for the wrong domain. In Gmail's "Show original", look at which domain SPF passed for. If it's your email service's domain (like amazonses.com) and not yours, set up the custom return path from Step 2.
Two SPF records. Merge them into one.
Forwarded emails fail SPF. That's normal, because the forwarding server isn't in your record. It's one reason DKIM matters so much (see How to set up DKIM for Mautic).
For domains you own but never send email from (parked domains, old brands), publish this record so nobody can pretend to send from them.
v=spf1 -all
~all or -allHow many includes are hiding in your SPF record right now? I'd love to hear the record-breaking counts people find in the wild, and how you tidied them up, over on the Mautic forum or in Slack.
Kitterman, S. (2014) Sender Policy Framework (SPF) for authorizing use of domains in email, version 1. RFC 7208. Internet Engineering Task Force. Available at https://www.rfc-editor.org/rfc/rfc7208.html (Accessed 26 October 2026).
Article Number: 242
Author: Oct 26, 2026
Last Updated: Oct 26, 2026
Author: Ruth Cheesley [[email protected]]
Online URL: https://kb.mautic.org/article/how-to-set-up-spf-for-mautic.html