Defaults.Exposed › Setup walkthroughs › SPF › Porkbun

How to set up SPF on Porkbun

Porkbun is the one console in this set where you don’t type @. Porkbun’s own guide says to leave the Host field blank for a record at the root of the domain, which is where SPF (Sender Policy Framework) belongs. Leave it blank and check the saved row shows the bare domain.

The record, and Porkbun’s field names

SPF is one TXT (Text) record at the root of the domain holding a line that starts v=spf1 and names the servers allowed to send mail as you. Porkbun calls the value field Answer where most consoles call it Value, so instructions copied from elsewhere will not line up field for field.

Porkbun publishes nothing about SPF on its own. It stores exactly the TXT record you type into the Answer field and holds it against the domain’s nameservers. It does not generate an SPF value itself; you take that string from your email provider and publish it here.

Check the authoritative nameservers

Open the domain in the Porkbun account and read the Authoritative Nameservers section. Porkbun’s own nameserver set is the curitiba, fortaleza, maceio and salvador names, so if those are showing, Porkbun is running the domain’s DNS (Domain Name System) and the record belongs here. If the section shows another company’s nameservers instead, such as Cloudflare, a web host or an email provider, the SPF record has to go there, and adding it at Porkbun has no effect.

Add the record in Porkbun

1. Sign in to Porkbun and open Account, then Domain Management.
2. Find the domain in the list and click its Details arrow.
3. Choose DNS Records to open the DNS editor.
4. Review the existing records for one that already starts with v=spf1.
5. If an SPF record is already present, open that record to edit it rather than adding another.
6. To add a new record, set Type to TXT.
7. Leave the Host field blank so the record applies to the domain itself.
8. Paste the SPF string into the Answer field with no surrounding quotes.
9. Leave TTL (Time to Live) at the default, 600 is fine.
10. Click Add, or Save if editing an existing record.

Leave Host blank, since Porkbun treats an empty Host as the root domain and appends nothing else to it. Put the SPF string in the Answer field, typed plain with no quotes around it. Leave TTL at the Porkbun default of 600.

Traps on this console

• Porkbun treats an empty Host field as the root domain and does not use @ for root records, so leave Host blank rather than typing @.
• The Answer field takes the SPF string plain. Porkbun stores it correctly without quotes, and wrapping it in double quotes can break the record.
• Porkbun allows only one SPF record per domain. A second v=spf1 TXT record is an error and breaks SPF entirely, so an extra sender goes into the existing record as another include: entry, not into a new TXT record.
• The DNS Records screen lists every record on the domain, so the existing SPF record, if there is one, sits right there among Porkbun’s own defaults and is easy to miss on a quick scan.
• A line that needs more than ten DNS lookups to resolve fails with a permanent error, and every include: spends from that budget whether or not it is reached.

Ending the line

-all lets a receiver reject mail from an unlisted server on SPF alone, which can bounce forwarded mail before DKIM (DomainKeys Identified Mail) is checked. ~all marks that mail as a soft fail and leaves the decision to your DMARC (Domain-based Message Authentication, Reporting and Conformance) policy. Both endings are defensible; whichever you choose, list every sender first. For scale, the October 2026 census found 87,173,390 domains (26.2%) ending on softfail and 175,426,748 (52.8%) with no SPF record at all.

Reading the DNS Records screen

Porkbun’s editor shows every record on the domain in one list, including the defaults it created when the domain was registered, so the SPF line sits among other rows. Tell them apart before you edit anything.

The SPF record is the TXT row with a blank Host and an Answer starting v=spf1. A DKIM record is a TXT or CNAME (Canonical Name) row at a host ending ._domainkey. A DMARC policy is a TXT row at _dmarc starting v=DMARC1. Anything else at the root beginning with a random-looking token is usually a service proving you own the domain, and it can be left alone.

More than one TXT record at the root is normal. The one-record rule applies only to lines starting v=spf1, so verification tokens are not a conflict and do not need removing.

Inside the SPF line itself, include: pulls in a sending service’s own published list, a authorises whatever address the domain points at, mx authorises whatever receives mail for it, and ip4: names an address or range directly. Only the first three cost anything against the ten-lookup budget a receiver allows, which is why a long record built from includes fails while a long record built from ip4: ranges does not.

Wait, then check it

A saved change is not instant at Porkbun; it can take from a few minutes up to a couple of hours to show everywhere. The saved record then appears listed on the same DNS Records screen used to add it. Reopen DNS Records at Porkbun and confirm only one line starts with v=spf1, with the Host field showing as blank or as the root.

Give it a little time, then run the free scan against your domain, which resolves the record from outside rather than reading it back from the editor.

How the scan grades this record: the SPF record check, with its pass and fail rules and how many domains pass it.

Publishing SPF does not stop someone forging the visible From address on mail claiming to be from the domain. SPF authorises the envelope sender; it is the DMARC policy that governs what a receiver does when authentication fails. The SPF guide covers the evaluation in full.

Figures from the defaults.exposed census, data as of 12 October 2026. Census numbers move every month; the current values are on the census data page.