Defaults.Exposed › Setup walkthroughs › SPF › Timeweb

Editing the SPF record Timeweb already made

Timeweb already publishes an SPF (Sender Policy Framework) record for a delegated domain, reading v=spf1 include:_spf.timeweb.ru ~all. That line covers mail sent through Timeweb’s own servers and nothing else. If you also send through Google Workspace, Microsoft 365 or a newsletter tool, none of that mail is authorised by the record sitting in your zone right now, and the fix is an edit rather than a new record.

Edit the existing line, never add a second

v=spf1 include:_spf.timeweb.ru ~all
v=spf1 include:_spf.timeweb.ru include:_spf.google.com ~all

Compare that block against what your mail provider’s own setup page tells you to publish.

Timeweb usually pre-creates one SPF record for a delegated domain, so edit that record. Two v=spf1 records on the same domain is a broken state, and receivers stop evaluating rather than choosing between them. Equally, dropping include:_spf.timeweb.ru from the record while Timeweb mailboxes or the Timeweb-hosted site still send mail stops that mail authenticating.

Timeweb publishes and edits the domain’s DNS (Domain Name System) records; it does not decide which of your other mail senders belong in them. It leaves you to add any other sender, such as Google Workspace, Microsoft 365 or a newsletter tool, into that same record by hand.

Which panel holds the domain

Timeweb is the company answering DNS for the domain when the nameservers are delegated to it, through either the classic hosting panel at timeweb.com or the Timeweb Cloud panel at timeweb.cloud. Timeweb’s DNS editor only affects domains delegated to Timeweb’s nameservers, in either panel. If the nameservers point at another company, such as Cloudflare, a different host or the mail provider itself, the SPF record belongs there instead.

Confirm in the console which of the two Timeweb panels, classic or Cloud, holds the domain, since the two do not share records. A domain managed in the Cloud panel does not pick up edits made in the classic panel, and the reverse.

Edit the record

Sign in to the classic hosting panel and go to «Домены и SSL» (Domains and SSL), then «Мои домены» (My domains).
Click the row that shows your domain to open its settings.
Open the «Редактор DNS» (DNS editor) tab for that domain.
Find the existing TXT (Text) record starting v=spf1 and edit it, or click «Добавить запись» (Add record) and choose type TXT.
In the «Хост» (Host) field leave the domain itself selected, and in the «Значение» (Value) field enter the SPF text.
Leave TTL (Time to Live) at the default value and save the record.

In the Timeweb Cloud panel, go to «Домены и SSL» and click the gear icon beside the domain, or open the domain and its DNS tab. Click «Добавить запись» (Add record), choose TXT, and fill in the value the same way, or edit the existing v=spf1 record directly.

In both panels the type field takes TXT and the host or name field is left on the domain itself, since Timeweb does not require a subdomain prefix for this record. The value or content field takes the plain SPF text starting v=spf1, with no added quote marks around it, and TTL stays at the panel’s default.

Traps on this console

Adding a new SPF record instead of editing the one Timeweb usually pre-creates leaves two v=spf1 records on the domain, a broken state.
Pasting the value with hand-added quote marks around it can corrupt the record, since Timeweb expects the plain text starting v=spf1 with no quotes added.
Timeweb’s default ends in ~all. -all lets a receiver reject mail from an unlisted server on SPF alone, which can bounce forwarded mail before DKIM (DomainKeys Identified Mail) is checked. ~all marks that mail as a soft fail and leaves the decision to your DMARC (Domain-based Message Authentication, Reporting and Conformance) policy. Both endings are defensible; whichever you choose, list every sender first.
Every include: you add spends from a ten-DNS-lookup budget a receiver enforces, and a record that exceeds it fails with a permanent error rather than dropping the surplus.

For scale on the softfail decision: in the October 2026 census 87,173,390 domains (26.2%) end their SPF record on softfail, and 175,426,748 (52.8%) publish no SPF record at all.

When mail moves away from Timeweb

The record Timeweb pre-created describes a domain whose mail goes through Timeweb. Most domains that reach this page are in the middle of that no longer being true, either because the mailboxes moved to Google Workspace or Microsoft 365, or because a mailing tool was added alongside.

While both are sending, both belong in the line. Once Timeweb sends nothing for the domain, include:_spf.timeweb.ru should come out, because it authorises a service you no longer use and spends from a lookup budget you may want for something else.

Be careful about what counts as sending, though. A site hosted at Timeweb that emails order confirmations or contact-form submissions is sending, even though nobody thinks of it as mail. That traffic leaves from Timeweb’s servers and is covered by the Timeweb include, so removing the include the same week you move the mailboxes stops those order confirmations authenticating.

include: pulls in a service’s own published server list and keeps current as that service changes. a authorises whatever address the domain’s A record points at. mx authorises whatever answers mail for the domain. ip4: names an address or range directly, which suits a server you control and suits a large provider badly, since their addresses change without notice.

Wait, then check it

Timeweb ties the wait to the record’s own TTL rather than giving a fixed span, so check the TTL value saved on the record in the DNS editor tab of whichever panel holds the domain.

When the TTL has had time to turn over, run the free scan against your domain. It resolves the published line from outside, which confirms both that your edit reached the live zone and that the panel you edited is the one the domain delegates to.

How the scan grades this record: the SPF record check, with its pass and fail rules and how many domains pass it.

SPF is checked against the envelope sender rather than the visible From address, which is the gap DMARC closes; the SPF guide covers the check itself.

Figures from the defaults.exposed census, data as of 12 October 2026. Census numbers move every month; the current values are on the census data page.