How to set up SPF on Bluehost

Add an SPF record in your Bluehost DNS so the world knows which servers may send email using your domain.

Why this matters to your business

SPF (Sender Policy Framework) is a short note in your domain’s DNS that lists which mail servers are allowed to send email “from” your domain. Without it, scammers can forge your address to send invoices, payment requests or fake quotes to your customers and suppliers — and your own legitimate email is more likely to land in spam. Setting SPF up is free, takes a few minutes, and is one of the strongest, cheapest things you can do to protect your name and keep your email getting delivered.

Before you start: is Bluehost actually running your DNS?

This is the single most common reason these changes “do nothing.” A DNS record only takes effect if Bluehost is where your domain’s nameservers point.

If you registered the domain with Bluehost and use its hosting and DNS, you’re likely in the right place.
If you point your domain at someone else’s nameservers (for example Cloudflare, another web host, or your email provider), then the SPF record must be added there, not at Bluehost. Adding it at Bluehost will have no effect.

In your Bluehost account, open Domains and check the Nameservers / DNS details for your domain. If it shows Bluehost’s own nameservers, continue below. If it shows another company’s nameservers, go add SPF in that company’s DNS instead.

What you’ll add

A single TXT record that lists your senders. The exact value depends on who sends your email. A common example for a domain that sends only through Microsoft 365 is:

v=spf1 include:spf.protection.outlook.com -all

For Google Workspace it’s usually:

v=spf1 include:_spf.google.com ~all

Use the SPF value your email provider tells you to use. You should have only one SPF (TXT starting with v=spf1) record per domain — if you already have one, edit that one rather than adding a second.

Steps in Bluehost

Sign in to Bluehost and open the Domains section of your account.
Select your domain and open its DNS records (look for DNS, DNS Records, or the Zone Editor).
Review the existing records. Bluehost hosting accounts usually carry a default SPF record — if one exists, edit that one rather than adding a second.
To add a record, choose TXT as the type.
In the Name (sometimes called Host Record) field, enter @. The @ means “the domain itself.” Do not put your full domain name here.
In the TXT Value (sometimes called Record or Value) field, paste your SPF string, e.g. v=spf1 include:spf.protection.outlook.com -all.
Leave TTL at the default.
Click Add Record (or Save).

Bluehost quirks people get wrong

Check for the default SPF first. Bluehost hosting accounts often pre-populate an SPF record. Ending up with two v=spf1 records breaks SPF entirely — edit the existing one rather than adding a second.
@ for the name, not your domain. Putting the full domain in the Name field creates the record at the wrong place.
No quotes. Type the SPF value plain. Do not wrap it in double quotes — Bluehost handles the quoting itself, and pasting a quoted value can result in a broken record.
Combine senders, don’t stack records. If you add a second sender (say you start using a newsletter tool as well), combine them into one record using extra include: entries — don’t create a second TXT.
Changes aren’t instant. DNS can take from a few minutes up to a couple of hours to update everywhere.

Verify it worked

Once saved, confirm the record is live and correct with the free check on Defaults.Exposed. Enter your domain and it’ll tell you in plain language whether your SPF is set up properly. Your data is processed in the EU.

Done? Check your domain free to confirm it worked — and see your full grade across all 34 checks.