SPF Configuration
SPF (Sender Policy Framework) is a DNS record that prevents spammers from sending emails using your domain (yourdomain.com).
Overview
Sender Policy Framework (SPF) is an email authentication standard that lists the specific servers and IP addresses authorized to send emails on behalf of your domain name.
Why It's Needed
When an email is sent from your domain, the recipient's mail server checks your SPF record to verify if the sending server is authorized by you. If the server is not on the list, the email may fail authentication and be marked as spam or rejected entirely. Adding this record tells receiving servers that Simply Send is officially authorized to deliver emails for you, preventing them from being flagged as spoofed spam.
Step 1: Retrieve Your SPF Record
Log in to Simply Send, go to the Domains page, select your domain, and navigate to the DNS Records page. Under the Email Authentication section, you will find your pre-generated SPF record.
Step 2: DNS Record Specifications
You must add or update a TXT record with your DNS provider (e.g., Cloudflare, Route53, GoDaddy) using these exact details:
| Record Type | Host / Name | Value / Content | TTL | Verification Status |
|---|---|---|---|---|
| TXT | yourdomain.com | v=spf1 include:amazonses.com include:rp.oracleemaildelivery.com -all | Auto / 1 hour | Mandatory |
Step 3: Configuration Guide & Critical Considerations
Before adding any new records, you must verify if you already have an SPF record. Log in to your DNS provider and check your existing TXT records on the root domain (usually denoted by @ or left blank). Look for any record that begins exactly with v=spf1. Depending on what you find, follow one of the scenarios below:
Verification Tip: Not sure if you have an SPF record? You can enter your domain on MxToolbox, or look up the TXT records from your computer: on macOS or Linux use dig TXT yourdomain.com +short; on Windows Command Prompt use nslookup -type=TXT yourdomain.com; in Windows PowerShell use Resolve-DnsName yourdomain.com -Type TXT.
AScenario A: You do not have an existing SPF record
Add a brand new TXT record containing the exact value provided in your dashboard:
BScenario B: You already have an existing SPF record
Do not create a second SPF record! Doing so will cause both to fail. Instead, edit your existing record and insert the Simply Send requirements (include:amazonses.com include:rp.oracleemaildelivery.com) right before the final ~all or -all tag.
CScenario C: You already have more than one SPF record
Older email providers often leave their own v=spf1 TXT behind. Three SPF records is still invalid. Merge every include: you still need into one TXT, then delete the extra SPF records. Until you do, Verify can pass on one click and fail on the next because DNS returns those records in a different order.
Important Rules for Merging Email Services
You can only have one SPF record per domain. If you use multiple email delivery services (e.g., Simply Send and Google Workspace or Microsoft 365), you must combine them into a single record.
Example Combined Record:
Multiple SPF Records Fail
Having two separate TXT records starting with `v=spf1` will cause permanent authentication failures (PermError) for receiving mail servers.
10 DNS Lookups Limit
The SPF protocol limits records to 10 nested DNS lookups. Combining too many `include:` statements from different services will break verification.
Apex SPF vs MAIL FROM SPF
The record in the table above belongs on the apex (@ / yourdomain.com). Simply Send also requires a separate TXT on return-a.yourdomain.com for custom MAIL FROM. That value is only v=spf1 include:amazonses.com -all plus an MX record. Do not copy the apex SPF onto return-a, and do not replace the apex record with the MAIL FROM value. See the MAIL FROM / MX guide.
Host / name field
Use @ or a blank host for the apex. If the panel asks for a hostname, enter the domain once. Adding yourdomain.com on a zone that already suffixes the domain creates yourdomain.com.yourdomain.com.
Quotes and proxies
Paste the TXT value without extra quotation marks. Keep the record DNS-only (grey cloud in Cloudflare). A proxied TXT will not verify.
For a shorter walkthrough of these mistakes, see How to Set Up Your SPF Record Correctly.
Step 4: Verify and Activate
Wait for Propagation
DNS changes can take anywhere from a few minutes to 24 hours to update globally across all DNS servers.
Enable in Console
Once DNS shows the merged record, click Verify. Each click reads live DNS and overwrites the domain status — it is not sticky. If extra SPF records remain, status can return to pending.
Next Step: Digital Signatures (DKIM)
Encrypt your email headers with DKIM to ensure messages are not tampered with during transit.
Configure DKIM