> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mailchannels.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up SPF records for MailChannels Outbound Filtering

> Add MailChannels to your domain's SPF record to authorize outbound delivery, prevent spoofing, and ensure recipient servers accept your email.

Sender Policy Framework (SPF) tells receiving mail servers which IP addresses are authorized to send email for your domain. When you relay through MailChannels, messages leave from MailChannels' shared IP pool — not your own servers. Without an SPF record authorizing those addresses, recipients may reject your mail or mark it as spam, and your domain becomes easier to spoof.

To authorize MailChannels, add a single `include` reference to your existing SPF record. MailChannels maintains its own SPF record, so it always reflects the current sending addresses — you don't need to update anything when IPs change.

## Required DNS records

You need two DNS records for full SPF coverage with MailChannels.

### SPF record (for your sending domain)

Add or update the TXT record for your domain:

| Location      | Type | Value                                             |
| ------------- | ---- | ------------------------------------------------- |
| `example.com` | TXT  | `v=spf1 a mx include:relay.mailchannels.net ~all` |

Replace `example.com` with your actual domain name.

If you already have an SPF record, add `include:relay.mailchannels.net` to it — do not create a second SPF record. Only one SPF TXT record is permitted per domain. Place the `include` before the `all` mechanism, since `all` always matches and must appear at the end.

**Example — adding MailChannels to an existing SPF record:**

```txt Before theme={null}
v=spf1 a mx include:sendgrid.net ~all
```

```txt After theme={null}
v=spf1 a mx include:sendgrid.net include:relay.mailchannels.net ~all
```

### Domain Lockdown record (strongly recommended)

<Warning>
  Including the MailChannels SPF record without also adding the Domain Lockdown TXT record makes it easier for other MailChannels customers to send email that appears to come from your domain. Always add the `_mailchannels` subdomain record.
</Warning>

| Location                    | Type | Value                          |
| --------------------------- | ---- | ------------------------------ |
| `_mailchannels.example.com` | TXT  | `v=mc1 auth=<your-account-id>` |

Replace `<your-account-id>` with the Account ID shown in your [Host Console](https://console.mailchannels.net). This record tells MailChannels that only your account is authorized to send from your domain, locking out any other MailChannels account from spoofing it.

If you cannot configure Domain Lockdown right away, you can use a neutral qualifier as a temporary measure:

```txt theme={null}
v=spf1 a mx ?include:relay.mailchannels.net ~all
```

A `?` qualifier produces a neutral SPF result. This allows messages from MailChannels to be accepted by hosts that would otherwise reject on SPF failure, but it does not help with DMARC alignment (which will depend on DKIM only until Domain Lockdown is configured).

## Verify your SPF record

After updating your DNS, confirm the record is correct using `dig` or `nslookup`:

<CodeGroup>
  ```bash dig theme={null}
  dig TXT example.com +short
  ```

  ```bash nslookup theme={null}
  nslookup -type=TXT example.com
  ```
</CodeGroup>

You should see your SPF record in the output. Look for the `include:relay.mailchannels.net` entry.

To verify the Domain Lockdown record:

```bash theme={null}
dig TXT _mailchannels.example.com +short
```

You can also use online tools to inspect the full expanded list of MailChannels IP addresses:

* [MXToolbox SPF lookup for MailChannels](https://mxtoolbox.com/SuperTool.aspx?action=spf%3arelay.mailchannels.net\&run=toolpage)
* [Dmarcian SPF survey for MailChannels](https://dmarcian.com/spf-survey/relay.mailchannels.net)

<Note>
  DNS changes can take up to 48 hours to propagate, though most resolvers pick up changes within minutes to a few hours.
</Note>

## Common SPF mistakes

**Creating two SPF records for the same domain** — Only one `v=spf1` TXT record is allowed per domain. If you add a second one, both records become invalid. Edit your existing record instead of creating a new one.

**Placing `include:relay.mailchannels.net` after `all`** — The `all` mechanism matches everything, so any mechanisms after it are ignored. Always put `include` statements before the `all` at the end.

**Exceeding the 10 DNS lookup limit** — SPF records are limited to 10 DNS lookups during evaluation. If you have many `include` statements, you may hit this limit. Use an SPF flattening tool to consolidate lookups if needed.

**Using `-all` (hard fail) without testing first** — A `-all` suffix causes receiving servers to reject messages that don't match. A `~all` (soft fail) is safer during initial setup because it marks non-matching messages rather than rejecting them outright. Switch to `-all` once you are confident your record is complete.

## cPanel bulk SPF setup

If you manage many domains in cPanel, you can add SPF records in bulk using the `spf_installer` script from the command line:

```bash theme={null}
cd /var/cpanel/users
for i in $(ls /var/cpanel/users); do /usr/local/cpanel/bin/spf_installer $i; done
```

<Note>
  The spf\_installer is a built-in cPanel/WHM script that lets system administrators add or update SPF.
  [cPanel Documentation](https://docs.cpanel.net/whm/scripts/the-spf_installer-script/)
</Note>

<Warning>
  Test this script on a single account before running it across all users in a production environment.
</Warning>

## Next step

Once your SPF records are in place, configure your mail server to relay through MailChannels:

<Card title="Configure your mail server" icon="server" href="/outbound/configure-mail-server">
  Set up your MTA to use MailChannels as a smart host for outbound delivery.
</Card>