SPF Record Examples: Copy-Paste Records for Google, Microsoft 365, SendGrid & More (2026)

Every SPF record listed below is copy-paste ready — publish it as a single DNS TXT record at your domain apex. Each example shows the exact record string, the DNS lookup count it consumes from the RFC 7208 limit of 10, and what to watch out for. If your combination isn’t listed, the rules at the bottom show how to build your own.

These records are current as of April 2026. Vendor include chains change when providers add or retire sending infrastructure — if you need a record that auto-updates when vendors change their IPs, that is exactly what AutoSPF’s flattening service does.

What Is the Correct SPF Record for Google Workspace?

Copy-paste record:

v=spf1 include:_spf.google.com -all

DNS lookups used: 4 of 10

Google’s _spf.google.com include chains to three _netblocks records internally (_netblocks.google.com, _netblocks2.google.com, _netblocks3.google.com), each of which consumes one additional lookup. Total: 1 (the top-level include) + 3 (netblocks) = 4 lookups. Per Google’s sender guidelines, this single include covers Gmail, Google Groups, and Calendar notifications.

Watch out for: Google’s include alone uses 4 of your 10 lookups, leaving only 6 for all other senders. If you also use SendGrid (5 lookups), the combined total is 9 — one more sender and you hit the wall.

What Is the Correct SPF Record for Microsoft 365?

Copy-paste record:

v=spf1 include:spf.protection.outlook.com -all

DNS lookups used: 2 of 10

Microsoft 365’s include is lighter than Google’s — it chains to one nested include, consuming 2 total lookups. This is per Microsoft’s SPF configuration documentation.

Watch out for: If you use Exchange hybrid (on-premises + cloud), you may also need ip4: entries for your on-premises mail servers. Those don’t consume lookups.

What Is the Correct SPF Record for Google Workspace + SendGrid?

Copy-paste record:

v=spf1 include:_spf.google.com include:sendgrid.net -all

DNS lookups used: 9 of 10

This is the most common combination that pushes organizations dangerously close to the 10-lookup limit. Google uses 4 lookups, SendGrid uses approximately 5 (its include chains to multiple regional sending infrastructure records). Total: 9. Adding even one more include, a, or mx mechanism will exceed the limit and trigger a PermError.

Watch out for: If you need to add any other sender (Mailchimp, Salesforce, HubSpot, a support desk), you will exceed 10 lookups. The fix is either SPF flattening (replacing includes with resolved IP addresses) or SPF macros (delegating resolution to a per-query lookup). AutoSPF handles both approaches.

What Is the Correct SPF Record for Microsoft 365 + SendGrid?

Copy-paste record:

v=spf1 include:spf.protection.outlook.com include:sendgrid.net -all

DNS lookups used: 7 of 10

Microsoft (2) + SendGrid (5) = 7. Safer than Google + SendGrid but still leaves only 3 lookups for other senders.

What Is the Correct SPF Record for Google Workspace + Microsoft 365?

Copy-paste record:

v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all

DNS lookups used: 6 of 10

This combination is common during migrations from one platform to the other, or when an organization uses Google for corporate email and Microsoft for specific legacy applications. Google (4) + Microsoft (2) = 6 lookups.

What Is the Correct SPF Record for Google Workspace + Mailchimp?

Copy-paste record:

v=spf1 include:_spf.google.com include:servers.mcsv.net -all

DNS lookups used: 5 of 10

Mailchimp’s include (servers.mcsv.net) is lightweight — typically 1 lookup. Combined with Google’s 4, total is 5. Plenty of headroom for additional senders.

What Is the Correct SPF Record for Microsoft 365 + Mailchimp + HubSpot?

Copy-paste record:

v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net include:spf.hubspot.com -all

DNS lookups used: 5 of 10

Microsoft (2) + Mailchimp (1) + HubSpot (2) = 5 lookups. A comfortable budget with room for 5 more lookups.

What Is the Correct SPF Record for Google Workspace + Salesforce?

Copy-paste record:

v=spf1 include:_spf.google.com include:_spf.salesforce.com -all

DNS lookups used: 6 of 10

Salesforce’s _spf.salesforce.com typically uses 2 lookups. Combined with Google (4), total is 6.

What Is the Correct SPF Record for Google + Microsoft 365 + SendGrid + Mailchimp?

Copy-paste record:

v=spf1 include:_spf.google.com include:spf.protection.outlook.com include:sendgrid.net include:servers.mcsv.net -all

DNS lookups used: 12 of 10 — EXCEEDS THE LIMIT

This is the exact scenario where SPF breaks. Google (4) + Microsoft (2) + SendGrid (5) + Mailchimp (1) = 12 lookups. RFC 7208 §4.6.4 caps evaluation at 10. The receiving mail server returns a PermError and every message from the domain fails SPF authentication, regardless of which sender it comes from.

The fix: Use AutoSPF to flatten the includes into resolved IP addresses or switch to SPF macros. Flattening replaces the include: mechanisms with ip4: and ip6: entries that consume zero lookups, bringing the total back under 10. AutoSPF monitors the upstream vendors’ IP ranges and re-flattens automatically when they change — typically every 15 minutes.

What Is the Correct SPF Record for Google + Brevo (Sendinblue)?

Copy-paste record:

v=spf1 include:_spf.google.com include:spf.brevo.com -all

DNS lookups used: 6 of 10

Brevo’s include (spf.brevo.com) typically uses 2 lookups. Combined with Google (4), total is 6. Remember that Brevo also requires two DKIM CNAME records (mail._domainkey and mail2._domainkey) — SPF alone is not sufficient for full authentication per Google’s and Yahoo’s February 2024 bulk sender requirements.

How Do You Build Your Own SPF Record?

If your vendor combination isn’t listed above, follow these rules:

1. Start with v=spf1 — this is required and must be first.
2. Add ip4: and ip6: entries for any static IPs that send mail (e.g., your on-premises mail server). These consume 0 lookups.
3. Add include: entries for each third-party email service. Check the service’s documentation for the exact include string. Each include consumes 1 lookup plus whatever nested lookups the included record contains.
4. End with -all (hard fail) or ~all (soft fail). Use -all in production; use ~all only during initial testing.
5. Count your total lookups. Add up: 1 per include, 1 per a mechanism, 1 per mx mechanism, 1 per exists, and 1 per redirect. Include nested lookups inside each vendor’s include chain (use our free SPF checker to count automatically). The total must be ≤ 10.
6. Publish as a single TXT record at the domain apex (e.g., example.com). You can only have one SPF record per domain — RFC 7208 §3.2 treats multiple records as a PermError.

What Are the Most Common DNS Lookup Costs by Vendor?

Vendor	Include mechanism	Approximate lookups
Google Workspace	include:_spf.google.com	4
Microsoft 365	include:spf.protection.outlook.com	2
SendGrid	include:sendgrid.net	5
Mailchimp	include:servers.mcsv.net	1
Amazon SES	include:amazonses.com	2
Salesforce	include:_spf.salesforce.com	2
HubSpot	include:spf.hubspot.com	2
Brevo (Sendinblue)	include:spf.brevo.com	2
Mailgun	include:mailgun.org	2
Mimecast (US)	include:_netblocks.mimecast.com	2-4
Proofpoint	include:_spf.pphosted.com	2-4
Zoho Mail	include:zoho.com	2
Postmark	include:spf.mtasv.net	1
SparkPost	include:sparkpostmail.com	1

Lookup counts are approximate and may change when vendors update their sending infrastructure. Use the AutoSPF SPF checker to get the current live count for any domain.

What Happens When You Exceed 10 DNS Lookups?

Per RFC 7208 §4.6.4, if the total number of DNS mechanism lookups exceeds 10 during SPF evaluation, the check immediately returns a PermError. This is a permanent, unrecoverable failure — it does not matter whether the sending IP would have been authorized further down the record. Every message from the domain fails SPF.

The practical consequence: legitimate email from the domain is rejected or sent to spam by receivers that enforce SPF strictly (Gmail, Outlook.com, Yahoo). According to the FBI’s 2022 Internet Crime Report (IC3), Business Email Compromise caused $2.7 billion in losses in a single year — but a broken SPF record due to exceeding 10 lookups can make the problem worse by suppressing legitimate messages while doing nothing to stop attackers who spoof the domain without using its real SPF record.

The fix is SPF flattening or SPF macros. AutoSPF resolves include chains into static IP addresses (consuming 0 lookups each) and re-scans upstream vendors every 15 minutes to keep the flattened record current. For domains that need unlimited includes, AutoSPF also supports SPF macros, which delegate per-query resolution and bypass the 10-lookup limit entirely.

Related Reading

• best SPF checker tools
• SPF too many DNS lookups — how to fix it
• SPF flattening tools