SPF Configuration for Google Workspace, Zoho Mail, and PHP Website Forms
📅 22 Feb 2026
📂 General
👁 1 views
This article provides a practical technical reference for configuring Sender Policy Framework (SPF) when email is sent from multiple systems, including:
The document targets IT administrators, system engineers, and support professionals responsible for email deliverability, anti-spoofing controls, and DNS configuration.
Product / System Overview
Sender Policy Framework (SPF)
SPF is a DNS-based email authentication mechanism that:
-
Validates authorized sending servers
-
Helps prevent email spoofing
-
Improves deliverability
-
Supports DMARC enforcement
SPF records are stored as TXT records in DNS.
Technical Explanation
How SPF Works
When an email is received:
-
Receiving server extracts sender domain
-
Queries DNS for SPF TXT record
-
Compares sending server IP against allowed sources
-
Returns result: PASS / FAIL / SOFTFAIL / NEUTRAL
SPF Record Structure
Example:
| Mechanism | Purpose |
|---|
v=spf1 | SPF version identifier |
include: | Authorizes third-party sender |
ip4: / ip6: | Authorizes specific IP |
~all | SoftFail (non-authorized senders discouraged) |
-all | Fail (strict rejection) |
Architecture Considerations
SPF validates the sending server, NOT the application.
Mail Flow Examples:
SMTP-based sending
mail() function
SPF must authorize the actual sending infrastructure.
Use Cases & Environments
Common deployment scenarios:
| Environment | SPF Requirement |
|---|
| Google Workspace only | Include Google SPF |
| Zoho Mail only | Include Zoho SPF |
| Google + Zoho | Include both |
| PHP via SMTP | Include SMTP provider |
| PHP via mail() | Add server IP |
Implementation Steps
Step 1 — Identify Sending Sources
Inventory all outbound email systems:
✔ Google Workspace
✔ Zoho Mail
✔ Website SMTP
✔ Hosting mail server
✔ Third-party services (if any)
Step 2 — Construct SPF Record
Scenario A — Google Workspace + Zoho
Scenario B — Google + Zoho + PHP mail()
Example:
Scenario C — Strict Enforcement
Use only after verification.
Step 3 — DNS Configuration
Add TXT record in DNS:
| Field | Value |
|---|
| Type | TXT |
| Host | @ |
| Value | SPF Record |
Step 4 — Verify SPF
Use tools:
✔ Google Admin Toolbox
✔ MXToolbox SPF Checker
✔ dig / nslookup
Example:
Step 5 — Validate Mail Headers
Inspect received message source:
Look for:
And sending host:
Troubleshooting Procedures
Check SPF Resolution
SPF Syntax Validation
Common issues:
Common Errors & Fixes
Error: Multiple SPF Records
Symptom
Root Cause
Multiple TXT SPF entries.
Fix
Merge mechanisms into single record.
Error: SPF Lookup Limit Exceeded
Symptom
Root Cause
More than 10 includes / redirects.
Fix
Flatten SPF or remove redundant includes.
Error: SPF Fail from Website
Symptom
Emails marked as spoofed/spam.
Root Cause
Hosting server IP not authorized.
Fix
Add:
Error: SPF SoftFail
Symptom
Root Cause
Sender not listed; ~all policy.
Fix
Authorize sender or move to -all.
Security Considerations
Risks of Incorrect SPF
SPF Limitations
SPF:
✔ Validates envelope sender
✔ Does NOT prevent header spoofing
✔ Requires DMARC for full protection
Best Practices
✔ Maintain single SPF record
✔ Use includes instead of raw IP when possible
✔ Avoid excessive mechanisms
✔ Monitor SPF failures
✔ Align SPF with DKIM + DMARC
Recommended Production SPF
Typical modern configuration:
After validation.
Conclusion
SPF configuration must reflect actual mail flow, not assumptions about applications or platforms. Accurate sender identification, controlled DNS records, and periodic validation are essential for deliverability and anti-spoofing protection.
SPF alone is incomplete — combine with:
✔ DKIM
✔ DMARC
✔ TLS
For robust email authentication.
#SPF #EmailAuthentication #DNS #GoogleWorkspace #ZohoMail #EmailSecurity #DMARC #DKIM #SMTP #PHPmail #ITSupport #SysAdmin #MailServer #EmailDeliverability #DNSConfig #SPFRecord #EmailTroubleshooting #AntiSpoofing #CyberSecurity #DomainSecurity #EmailSetup #HostingServer #MailFlow #SPFFail #SPFSoftFail #DNSRecords #TXTRecord #EmailCompliance #SpamPrevention #SPFValidation #DNSLookup #EmailInfrastructure #MailSecurity #SPFConfig #TechnicalKB #ITKnowledgeBase #EmailAdmin #ServerSecurity #EmailProtocols #SPFMechanism #DNSManagement #EmailProtection #MailAuthentication #SPFGuide #EmailErrors #DNSPolicy #EnterpriseEmail #MailSystems #SecurityControls
spf
spf record
sender policy framework
spf configuration
spf google workspace
spf zoho
spf php mail
spf smtp
spf dns record
spf txt record
spf include google
spf include zoho
google workspace spf
zoho mail spf
php spf setup
website email sp
