Salesforce SPF record

Salesforce sends via _spf.salesforce.com. If your org sends mail “from” your domain (not through email relaying to your own mail server), you will typically add this include.

The SPF include for Salesforce

Authorize Salesforce by adding its mechanism to your single SPF TXT record:

v=spf1 include:_spf.salesforce.com ~all

Approximate lookup cost: 1 DNS lookup(s). Remember you have a budget of 10 total across every sender in the record.

Provider include values change occasionally. Confirm the current value in your Salesforce admin console before publishing, and never create a second v=spf1 record — a domain may have only one. Combine all senders into one record:

v=spf1 include:spf.protection.outlook.com include:_spf.salesforce.com ~all

Salesforce is a single-lookup include, but it is often added on top of Microsoft 365 or Google Workspace and a marketing tool — the stack that tips domains over the limit. Consider whether Salesforce email relaying (which sends through your existing provider) would remove the need for a separate include entirely.

When adding Salesforce pushes you over the limit

Every include you stack — your mailbox provider, this one, a marketing tool, a help desk — adds to the same 10-lookup budget. The moment recursive expansion crosses 10, receivers return permerror and your SPF stops passing. You cannot shrink the nested provider records, so the durable fix is to flatten the record or move to a single-lookup macro that stays in sync automatically.