example.com.au. IN TXT "v=spf1 mx ip4:184.108.40.206/32 include:spf.protection.outlook.com ~all" the "mx" means that any IP addresses listed in the MX records are allowed to send email the "ip4:220.127.116.11/32" is an IP address or block of addresses that can send, e.g. your local SMTP relay the "include:spf.protection.outlook.com" means that Office 365 domain can send email the "~all" means it's a soft fail. If you had made it a hard fail, using "-all", you'll probably get clients that can't send to some domains
|+all||pass||Allow all mail|
|-all||fail||Only allow mail that matches one of the parameters (IPv4, MX, etc) in the record|
|~all||softfail||Allow mail whether or not it matches the parameters in the record|
|?all||neutral||No policy statement|
Some examples of valid SPF records:
calibreone.com.au text = "v=spf1 mx include:spf.myconnectwise.net include:spf.protection.outlook.com ~all" microsoft.com text = "v=spf1 include:_spf-a.microsoft.com include:_spf-b.microsoft.com include:_spf-c.microsoft.com include:_spf-ssg-a.microsoft.com include:spf-a.hotmail.com ip4:18.104.22.168 ip4:22.214.171.124 ip4:126.96.36.199 ip4:188.8.131.52 ip4:184.108.40.206 -all" hotmail.com text = "v=spf1 include:spf-a.outlook.com include:spf-b.outlook.com ip4:220.127.116.11/25 include:spf.protection.outlook.com include:spf-a.hotmail.com include:_spf-ssg-b.microsoft.com include:_spf-ssg-c.microsoft.com ~all" Example with multiple approved IP addresses: <code>ato.gov.au text = "v=spf1 ip4:18.104.22.168 ip4:22.214.171.124 ip4:126.96.36.199 ip4:188.8.131.52 ip4:184.108.40.206 mx include:sge.net -all"