SPF (Sender Policy Framework) is a DNS record that lists which mail servers are allowed to send email on behalf of your domain. When another mail server receives a message claiming to be from you, it checks your SPF record to see if the sending server is on the approved list.
Why it matters for Workspace
When you send mail through Google Workspace, the message actually originates from Google’s servers, not your own. If your domain’s SPF record does not explicitly authorize Google’s servers, receiving mail systems have a legitimate reason to treat your mail with suspicion — or reject it outright.
The one-record rule
A domain can only have one SPF record. If you use other services to send mail — a CRM, a support ticketing tool, an invoicing platform — they all have to be listed inside the same single record, not added as separate SPF entries. This is the most common SPF mistake we see, and it usually happens when a second service is added to a domain that already had SPF configured for Google.
The lookup limit
SPF checks are limited to 10 DNS lookups. Every "include" mechanism in your record can trigger additional lookups behind the scenes. Domains that use several third-party mail services can quietly exceed this limit, causing SPF to fail even though the record looks fine at a glance.