One TXT record listing who is allowed to send as you — and the golden rule is one SPF record, not three.
Start to finish for a clean SPF record. Crumbs map to the Directions sections.
Write down everything that sends mail using your domain: your mailbox provider (Google Workspace, Microsoft 365), marketing or transactional tools (SendGrid, Mailchimp), your CRM, invoicing, and your own servers. Each gets one include or ip4 entry.
In your DNS host, you will add a single TXT record at the root of the domain (host @ or blank). If an SPF record already exists, edit that one rather than adding a second.
Start with v=spf1, add an include or ip4 for each sender, and end with ~all (soft fail) while testing, or -all (hard fail) once you trust it. Combine all senders into this single string.
v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.10 ~all
Save it as TXT at the root. Quotes are optional in most panels; do not wrap the whole thing in extra quotes that become part of the value.
SPF allows a maximum of ten DNS lookups; every include counts, and some includes nest more. Run it through an SPF checker. If you are over ten, the record returns permerror and effectively fails — flatten or drop unused includes.
Mail fails SPF even though the record looks right.
You likely have two SPF records. RFC allows only one TXT starting with v=spf1; merge them into a single record.
SPF checker reports permerror / too many lookups.
You exceeded ten DNS lookups. Remove senders you no longer use, or replace heavy nested includes with direct ip4 entries.
Forwarded mail fails SPF.
SPF breaks on forwarding by design. This is exactly why you also need DKIM and DMARC — DKIM survives forwarding.
Unsure whether to use ~all or -all.
Use ~all (softfail) while validating, then move to -all once aggregate DMARC reports confirm all real senders pass.
Honesty note: articles are drafted with AI assistance, then a human checks each one against the vendor's current setup flow before it publishes — nothing goes live unreviewed. Vendor interfaces still change; if a step looks different, the underlying record is what matters.