Short answer: SPF is a TXT record that lists the servers allowed to send email for your domain. For mail sent through HSJ Host, publish one record:
v=spf1 ip4:45.76.126.147 ~all| Type | Host / name | Value |
|---|---|---|
| TXT | @ | v=spf1 ip4:45.76.126.147 ~all |
Put it on the domain itself. The host is @, blank, or the bare domain, the same place you publish the MX record. It is not a record on www. If the website DNS is at another company, add the TXT record there. You do not need to move the website or change nameservers.
What the SPF record means
v=spf1 marks the TXT record as SPF. ip4:45.76.126.147 authorises the HSJ Host mail server to send as your domain. ~all is a soft fail for every other server. A receiver can treat mail from a server that is not listed as suspicious. It does not mean the record allows everyone, and it is not an instruction to deliver mail. Delivery is still the MX record’s job.
The record we publish uses ~all. A trailing -all is stricter and tells receivers to reject mail from any server you forgot to list. Do not change the published record to -all while you are still checking what else sends as the domain.
Add it once
A domain can have only one SPF record. If a TXT record already starts with v=spf1, edit that record. Do not add a second one. Two SPF records make both of them fail, and mail is more likely to be rejected or sent to junk. Other TXT records, such as a site verification or a DMARC record, are fine beside it. The rule is one record that starts with v=spf1, not one TXT record in total.
cPanel’s Email Deliverability screen is the place to check the result. If it reports more than one SPF record, a second v=spf1 is still published. Find both, keep a single combined record, and delete the spare.
If something else also sends your mail
If something else also sends as your domain, such as a website form, an invoicing app, or Microsoft 365, those senders have to be added to this same record. The record above only authorises HSJ Host. Copying it over the top of an existing SPF record will remove any other sender that was already listed, and mail from that service can start failing.
Copy the current value down before you edit it. Then add ip4:45.76.126.147 to that existing record, before the all mechanism at the end, and save it as one TXT record. Keep the other service’s existing mechanisms in the same line. If you are not sure what a mechanism belongs to, leave it there until you know. Removing it stops that service being authorised.
What SPF does not do
SPF does not choose where mail is delivered. That is the MX record. SPF tells other providers whether a message that claims to be from your domain was sent by a server you allow. DKIM signs the message so receivers can see it was not altered. DMARC tells receivers what to do when SPF or DKIM fails. Set the SPF record when you set the MX record. DKIM is copied from cPanel after that, because the DKIM value is different for every domain.
SPF also does not stop spam arriving in your inbox. It helps other providers decide whether mail that uses your domain name was sent by you. Someone can still write your address as a display name. The check that covers that is DMARC, and only after SPF and DKIM are in place.
How to check it
- In cPanel, open Email Deliverability and look at the SPF row for the domain. It should match the single record you published.
- Send a message from the mailbox to an outside address. If that provider shows authentication results, SPF for your domain should be a pass once DNS has updated.
- If legitimate mail from another service suddenly fails after the edit, the old sender was removed. Put its mechanism back into the same record. Do not fix that by adding a second SPF record.
DNS changes often show within an hour and can take 24 to 48 hours. For the hosting login, use the HSJ Host client portal. Do not send the account password by email. Phone support is available Monday to Friday, 9 am to 9 pm AEST/AEDT, on 1800 519 724. Support tickets can be submitted 24/7.