# SPF Record Construction

At the beginning of the record, <span style="color: rgb(255, 255, 255); background-color: rgb(0, 0, 0);">v=spf1</span> identifies this as an SPF record. At the end of the record, <span style="color: rgb(255, 255, 255); background-color: rgb(0, 0, 0);">-all</span> defines the policy. Dash - for hard-fail, tilde ~ for soft-fail. In between the identity and policy, each <span style="color: rgb(255, 255, 255); background-color: rgb(0, 0, 0);">include:</span> defines the server domain names that are authorized to send as this domain. Each <span style="color: rgb(255, 255, 255); background-color: rgb(0, 0, 0);">+ip4:</span> defines the IP addresses that are authorized to send as this domain.

Example

```generic
v=spf1 +ip4:<IP Address> include:<FQDN> ~all
```

<div class="code-toolbar" id="bkmrk--1"></div>Microsoft 365

```generic
v=spf1 include:spf.protection.outlook.com ~all
```

<div class="code-toolbar" id="bkmrk--2"><div class="toolbar">  
</div></div>Google Workspace

```generic
v=spf1 include:_spf.google.com ~all
```

<div class="code-toolbar" id="bkmrk--3"></div><table id="bkmrk-prefix-type-value-pr"><thead><tr><th>Prefix</th><th>Type</th><th>Value</th><th>PrefixDesc</th><th>Description</th></tr></thead><tbody><tr><td>  
</td><td>v</td><td>spf1</td><td>  
</td><td>The SPF record version</td></tr><tr><td>+</td><td>include</td><td>spf.protection.outlook.com</td><td>Pass</td><td>The specified domain is searched for an 'allow'.</td></tr><tr><td>+</td><td>include</td><td>emailus.freshservice.com</td><td>Pass</td><td>The specified domain is searched for an 'allow'.</td></tr><tr><td>+</td><td>include</td><td>relay.mailchannels.net</td><td>Pass</td><td>The specified domain is searched for an 'allow'.</td></tr><tr><td>~  
</td><td>all</td><td>  
</td><td>Fail</td><td>Always matches. It goes at the end of your record.</td></tr></tbody></table>

Further reading: [a great explanation of SPF](https://www.mailhardener.com/kb/spf).

## NEXT STEPS

Configure [DKIM](http://info.orangebench.com/books/internet-infrastructure/page/dkim-record-construction) Signature

Configure [DMARC](http://info.orangebench.com/books/internet-infrastructure/page/dmarc-record-construction) Reports