SPF record for Amazon Route 53

Does this page apply to you?

Run this first. Amazon Route 53 only matters if it is where your DNS or mail actually lives.

dig +short NS yourdomain.com

Expect: Names like ns-123.awsdns-45.com. They must match the public hosted zone you are editing; a private hosted zone is invisible to the internet.

Specific to Amazon Route 53

• Leave Record name empty for the root domain.
• The TXT value must be wrapped in double quotes in Route 53: "v=spf1 include:_spf.google.com ~all".
• The root TXT record set can hold several values, one per line, which is where site-verification strings usually sit. Add SPF as one line, but only one line may start v=spf1.

What you should end up with

Illustrative values. Use the exact host and value your provider shows you where it generates them.

Type  Name  Value
TXT  @  "v=spf1 include:_spf.google.com ~all"

What the receiving server does with this record

On every incoming message the receiver reads the domain in the envelope sender (the Return-Path), fetches its TXT records, picks the one that starts v=spf1, and checks whether the sending IP is covered. It is a check on which servers may send for a domain, not on the visible From address; DMARC is what ties the two together.

Mistakes that break it

• Two SPF records. A domain may have exactly one. Publish a second and SPF returns a permanent error, which receivers treat as a failure. Merge instead.
• Over ten lookups. Each include costs a lookup plus whatever is inside it. See the SPF lookup limit.
• A sender missing. Your sequencer, CRM and billing tool all send as your domain and each needs its include in this one record.
• Wrong domain. SPF is not inherited by subdomains. If you send from mail.yourdomain.com, that name needs its own record.

Check it from the command line

Replace yourdomain.com and look for exactly one line that starts with "v=spf1:

dig +short TXT yourdomain.com