You're sending cold emails. They look good. Your copy is solid. But half your emails are bouncing or landing in spam. You check your email deliverability report and see "SPF failed" next to a bunch of bounces.
SPF problems are the silent killer of cold email campaigns. Most people don't even know what SPF is until their delivery rate tanks. Then they panic.
Here's what you need to know: SPF (Sender Policy Framework) tells email servers whether you're actually authorized to send from your domain. If your SPF record is broken or missing, Gmail, Outlook, and every other provider will treat your emails as suspicious. You might still send them, but they won't land in inboxes.
The good news is SPF problems are fixable. Most of the time, it's not complicated. You just need to know what to check and in what order.
Why SPF Fails in the First Place
Before you fix anything, understand why SPF breaks for cold email senders specifically.
When you send cold email, you're usually sending through an email service (lemlist, Apollo, Instantly, etc.) or a mail server. These platforms need permission to send on your behalf. That permission comes from your SPF record - a text file in your domain's DNS settings.
Here's what goes wrong:
- No SPF record exists yet - You just bought your domain and never set one up. Most registrars don't create SPF records by default.
- SPF record is incomplete - You added it partially or forgot to include your email service provider.
- Multiple services, conflicting records - You're using three different email platforms and their SPF entries are fighting each other or you hit the SPF lookup limit (more on this later).
- Wrong SPF format - You copied a template but used the wrong IP address or mechanism for your specific provider.
The most common issue we see: people add an SPF record for their email service, but they're still sending from a wrong subdomain or a domain their service doesn't actually support.
Check Your Current SPF Record (Step 1)
First, see what you actually have right now.
Go to mxtoolbox.com and search for your domain name. Under "SPF Lookup," it'll show your current SPF record.
You're looking for a line that starts with v=spf1. If you see nothing or a default generic record, you need to build one.
Write down exactly what you see. You'll need this.
Get the Right SPF Entry From Your Email Service
Every cold email platform has its own SPF entry. You can't guess or copy from someone else - it has to match your specific service.
Here are the most common ones:
- lemlist:
include:sendingserver.net - Apollo:
include:apollo.sendingserver.io - Instantly:
include:instantlymail.com - Mailchimp (transactional):
include:mailchimp.com - SendGrid:
include:sendgrid.net
If you're using a service not listed here, go to their help docs and search for "SPF." They'll have the exact string you need. Copy it exactly - even one character off breaks it.
Build or Update Your SPF Record
Your SPF record should follow this basic structure:
v=spf1 include:sendingserver.net ~all
That's it for a simple setup. Break it down:
v=spf1- The version (always this)include:sendingserver.net- Your email service's SPF entry (replace with yours)~all- The softfail catch-all (means "probably not authorized, but don't reject it outright")
If you're using multiple services, add them all:
v=spf1 include:sendingserver.net include:apollo.sendingserver.io include:mailchimp.com ~all
Important: If you have more than 10 DNS lookups in your SPF record, it fails. Each "include:" counts as one lookup. If you're hitting the limit, consolidate services or contact support.
Add It to Your Domain DNS Settings
Log into wherever you registered your domain (GoDaddy, Namecheap, Google Domains, etc.).
Find "DNS Records" or "DNS Settings." You'll see options like A, CNAME, MX records. Add a new TXT record.
Set it up like this:
- Name/Host: @ (the @ symbol means your root domain, not a subdomain)
- Type: TXT
- Value: Paste your full SPF record (the whole line starting with v=spf1)
Save it. DNS changes take 15 minutes to a few hours to propagate. Wait at least 30 minutes before testing.
Test It
After 30 minutes, go back to mxtoolbox.com and run another SPF lookup on your domain.
You should see your new SPF record. Look for a green checkmark next to "SPF Record Found" - that means it's valid syntax.
If you see red warnings, read them carefully. Common issues:
- "Too many DNS lookups" - You have too many includes. Remove services you're not actually using.
- "Invalid syntax" - You copied the entry wrong. Double-check character-by-character.
- "No SPF record found" - It hasn't propagated yet or you added it to the wrong place in your DNS settings. Wait longer or check your registrar again.
Make Sure You're Sending From the Right Domain
This is the step people miss.
Your SPF record validates your domain - but only for emails sent directly from that domain. If you're sending from a subdomain or a different domain, SPF won't help.
In your email service, check the "From" address you're using in your campaigns. It should be something like [email protected], not [email protected] or [email protected].
If your platform requires a subdomain (some do), add that subdomain to your SPF record instead:
v=spf1 include:sendingserver.net ~all
But set this as a TXT record for mail.yourdomain.com instead of the root domain.
Check DKIM and DMARC Too
SPF is only one piece. You also need DKIM and DMARC to stay out of spam. If you want the full picture, we've got a deeper guide on all three, but the quick version: add DKIM from your email service the same way you added SPF, and set a basic DMARC record to v=DMARC1; p=none.
These take 5 minutes total and make a huge difference in keeping emails out of spam.
When to Rebuild Your Entire Setup
Sometimes SPF problems are symptoms of a deeper issue. If you're using five different email services, or you keep switching platforms, or your SPF record is already at the lookup limit - it might be time to consolidate.
Use one solid email service for cold email. Use another tool for transactional emails if you need it. That's it. Makes SPF, DKIM, and DMARC way simpler.
The Gap Between Knowing This and Running It at Scale
Setting up SPF once for your domain takes an hour. Doing it right across 10+ sending domains while managing campaigns, list-building, and copy - that's a different problem. You're constantly troubleshooting deliverability issues while trying to send campaigns and handle replies. When something breaks, you don't know if it's SPF, DKIM, your list quality, or something else entirely.
That's where we come in. At BEC Growth, we handle all of this - domain setup, authentication records, warm-up sequences, list management, and campaign execution. You focus on closing deals, and we make sure your emails actually reach inboxes.