How to add an SPF record on Amazon Route 53
SPF (Sender Policy Framework) is a TXT record on your domain that lists the servers allowed to send email on its behalf. Receivers check it on every message that claims to come from your domain — no SPF record, and your legitimate mail becomes hard to tell apart from spoofed mail.
The record lives at the root of your domain as a single TXT record starting with v=spf1. Exactly one SPF record is allowed — publishing a second one breaks SPF entirely (RFC 7208 treats it as a permanent error).
The record you'll add
TypeTXT
Record nameleave blankAmazon Route 53 fills in your domain for the root.
Value"v=spf1 include:_spf.google.com ~all"This example authorizes Google Workspace. Your record must list the services that actually send your mail — run the checker below and it generates the exact record for your domain.
TTL300 seconds is a good value; Route 53 changes reach its nameservers within about 60 seconds.
Steps on Amazon Route 53
- Open the Route 53 console (console.aws.amazon.com/route53/) and go to Hosted zones.
- Select your domain's hosted zone and click Create record.
- Leave Record name blank for the root domain, or enter just the prefix (like _dmarc).
- Pick the record type, paste the value — TXT values wrapped in double quotes — and create the record.
Amazon Route 53 quirks worth knowing
- ⚠TXT values must be enclosed in double quotes: "v=spf1 …". Values longer than 255 characters are split into multiple quoted strings on one line.
- ⚠Route 53 still offers a legacy record type named SPF — don't use it; AWS itself recommends TXT only.
Provider steps verified against AWS: Creating records in Route 53 on 2026-07-12.
Get the exact record for your domain
The free SPF checker reads your domain's live DNS, flags what's wrong, and generates the precise SPF record to publish — then rechecks to confirm the fix took.
Run the SPF checker →Frequently asked questions
- What goes in the Record name field on Amazon Route 53?
- Leave it blank for the root domain — Amazon Route 53 fills in your domain automatically.
- How long until the record is live?
- 300 seconds is a good value; Route 53 changes reach its nameservers within about 60 seconds. Receivers that cached your old DNS answers will pick the change up as the previous TTL expires.
- Can I have more than one SPF record?
- No. RFC 7208 requires receivers to treat multiple SPF records as a permanent error — the same as having a broken record. If you use several sending services, list them all in one record: v=spf1 include:serviceA include:serviceB ~all.