SPF for Transactional Email

Your Password Reset Emails Are Landing in Spam

A user clicks "Forgot Password" on your app. Your system sends the reset link through SendGrid. The user never sees it. They check spam — nothing. They try again. Same result. Your transactional email service is working fine. The problem is that your domain's SPF record doesn't authorize that service to send on your behalf.

The Transactional Email Problem

Transactional emails — password resets, order confirmations, shipping notifications, account alerts — are the most time-sensitive messages your application sends. Users expect them instantly. But if the sending service isn't listed in your SPF record, receiving mail servers can't verify the messages are legitimate.

The challenges with transactional email SPF:

Each provider has its own specific SPF include value, and they're not always easy to find in documentation
You likely use a transactional service alongside your corporate email (Google Workspace, Microsoft 365), meaning you need a merged SPF record
Some organizations use multiple transactional services for redundancy or different message types
Transactional services share IP pools by default, which affects deliverability beyond just SPF

Transactional email services send from their own infrastructure, not yours. Without SPF authorization, every password reset, order confirmation, and account notification from your app fails email authentication.

How SPF Creator Helps

Provider presets for all major services

SendGrid, Amazon SES, Mailgun, Postmark, SparkPost — select from the dropdown and the correct include is added. No hunting through documentation.

Combine with corporate email

Most organizations need their transactional service alongside Google Workspace or Microsoft 365. SPF Creator merges them into one record.

Lookup budget tracking

Each include consumes DNS lookups. SPF Creator shows the running total so you can plan which services fit within the 10-lookup limit.

Syntax you can trust

Copy a validated, properly formatted record. No risk of typos in critical include values.

Monitor your transactional email authentication

Make sure your password resets and order confirmations always pass SPF. Get daily monitoring alerts.

Start Monitoring

SPF Include Values for Transactional Services

Here are the correct SPF include values for the most popular transactional email services:

Service	SPF Include	Notes
SendGrid	include:sendgrid.net	Works for both free and paid plans
Amazon SES	include:amazonses.com	Same across all AWS regions
Mailgun	include:mailgun.org	Verify with your Mailgun dashboard
Postmark	include:spf.mtasv.net	Postmarks dedicated sending infrastructure
SparkPost	include:sparkpostmail.com	For SparkPost cloud accounts
Mandrill (Mailchimp)	include:spf.mandrillapp.com	Mailchimps transactional service

Provider SPF includes can change. While the values above are current, always confirm with your provider's documentation or DNS settings page. SPF Creator's provider presets are kept up to date.

Setting Up SPF for Transactional Email

Identify your transactional email provider

Check your application code or email service dashboard. Common providers are SendGrid, Amazon SES, Mailgun, and Postmark.

Open SPF Creator

Start a new SPF record. Your record begins with v=spf1.

Add your corporate email provider

If you use Google Workspace or Microsoft 365, add that first. This is typically your primary sending source.

Add your transactional service

Select your transactional email provider from the dropdown. The correct include is added automatically.

Check the lookup count

Verify you're within the 10-lookup limit. A typical Google Workspace + SendGrid combination uses about 5-6 lookups, leaving room for additional services.

Publish and test

Copy the record to your DNS. Then trigger a transactional email (like a password reset) and check the email headers for spf=pass. Run a quick check with SPF Record Check to confirm your record is valid before testing.

Common Transactional + Corporate Combinations

# Google Workspace + SendGrid
v=spf1 include:_spf.google.com include:sendgrid.net ~all

# Google Workspace + Amazon SES
v=spf1 include:_spf.google.com include:amazonses.com ~all

# Microsoft 365 + Postmark
v=spf1 include:spf.protection.outlook.com include:spf.mtasv.net ~all

# Microsoft 365 + Mailgun
v=spf1 include:spf.protection.outlook.com include:mailgun.org ~all

# Google Workspace + SendGrid + Mailchimp
v=spf1 include:_spf.google.com include:sendgrid.net include:servers.mcsv.net ~all

Managing Your Lookup Budget

If you use multiple transactional services (for example, SendGrid for email and Amazon SES as a fallback), each one adds to your DNS lookup count. Here are strategies to stay within the limit:

Use subdomains: Send transactional email from notify.yourdomain.com with its own SPF record. This gives you a fresh 10-lookup budget for that subdomain.
Consolidate providers: If possible, use one transactional service instead of two. Each provider you remove saves 1-2 lookups.
Use dedicated IPs: Some providers offer dedicated IP addresses. You can authorize those with ip4: mechanisms, which don't count as lookups.

Subdomain strategy

Many organizations send transactional email from a subdomain like mail.example.com or notify.example.com. This separates transactional reputation from your main domain and gives you more SPF lookup budget.

Beyond SPF, transactional email benefits significantly from DKIM signing — most providers like SendGrid and Postmark support it natively. Pair both with a DMARC policy to maximize deliverability for your critical application emails.

Pricing

Free

Up to 3 items
Email alerts
Basic support

Pro

$9/month

Unlimited items
Email + Slack alerts
Priority support
API access

Monitor Your New SPF Record

You've created your SPF record — now make sure it keeps working. The Email Deliverability Suite watches your SPF, DKIM, DMARC, and MX records daily and alerts you when something breaks.

Never miss an SPF issue

Monitor your SPF, DKIM, DMARC and MX records daily. Get alerts when something breaks.