If your carefully written proposals keep landing in spam folders, the first thing to check is your SPF record. SPF (Sender Policy Framework) is a DNS entry that lists the servers allowed to send email for your domain. Since Gmail and Yahoo tightened sender requirements, domains without SPF are treated as suspects by default — and many Nepali domains still have no record at all.

How SPF Works in One Paragraph

When your message arrives at a recipient server, that server looks up the TXT records of your domain, finds the one starting with v=spf1, and checks whether the sending server IP appears in the list. A match passes; a miss fails or soft-fails. The result feeds the spam scoring — and the DMARC policy if you have one.

Step-by-Step Setup

  1. List every service that sends as your domain: your web hosting server, Zoho or Google Workspace, a newsletter tool, your website contact form.
  2. Build the record. Typical examples:
    • cPanel hosting only: v=spf1 +mx +a ~all
    • Zoho Mail: v=spf1 include:zohomail.com ~all
    • Google Workspace: v=spf1 include:_spf.google.com ~all
  3. Add it as a TXT record on the root of your domain in your DNS zone (cPanel Zone Editor or your registrar panel).
  4. Wait for propagation — minutes to a few hours — then verify with an online SPF checker or by emailing a Gmail account and choosing Show original.

The Mistakes That Break SPF

  • Two SPF records: the standard requires exactly one; a second record makes both invalid. Merge all includes into a single record.
  • Exceeding 10 DNS lookups: too many include statements causes a permanent error. Prune unused services.
  • Using +all: that authorises the entire internet to send as you — worse than nothing.
  • Forgetting the website: contact form and invoice mail sent by your web server fails if the server is not in the record.

Choosing ~all vs -all

The record ends with a default rule. ~all (softfail) asks receivers to mark unlisted senders as suspicious; -all (hardfail) asks them to reject outright. Start with ~all while you confirm every legitimate sender is listed, then consider tightening to -all once reports are clean.

SPF Alone Is Not Enough

SPF breaks on forwarded mail and does not protect the visible From name. It is one leg of a three-legged stool with DKIM and DMARC — set up all three for reliable inbox placement in 2026. Every WebsNP email plan includes preconfigured records for our servers.

Frequently Asked Questions

Does SPF stop others spoofing my domain?

It helps receivers detect spoofing, but enforcement only becomes real once you add a DMARC policy on top.

My mail worked for years without SPF. Why now?

Gmail, Yahoo and Outlook all tightened bulk-sender and authentication rules from 2024 onward. Unauthenticated domains now degrade steadily.

Where do I edit DNS for a .com.np domain?

Wherever your nameservers point — usually your hosting cPanel. Register.com.np only delegates the nameservers.

Want your records audited? Our business email plans include full SPF, DKIM and DMARC setup — ask for a free deliverability check.