Add an SPF record at Hetzner

The SPF value for Hetzner

If the domain sends exclusively through the Hetzner mail servers, this record is enough. The include mechanism include:spf.your-server.de covers every Hetzner sending server, -all rejects all other senders.

v=spf1 include:spf.your-server.de -all

When other services send as well

A newsletter tool, CRM, ticket system or Microsoft 365 alongside the Hetzner mailboxes: every service goes into the same record as its own include. There must be only one TXT record with v=spf1; a second one invalidates both. At most ten DNS lookups are allowed, Google Workspace costs four, Microsoft 365 two, most newsletter tools one or two.

v=spf1 include:spf.your-server.de include:spf.protection.outlook.com include:spf.brevo.com -all

How to add the SPF record at Hetzner

The way to the Hetzner DNS editor:

• Open the Hetzner DNS Console (dns.hetzner.com) and select the zone of the domain.
• Choose "Add record", enter type, name and value, lower the TTL if needed.
• Type TXT, host name @ (at some hosts leave empty or pick the domain name), value: the full SPF record starting with v=spf1. If a TXT record with v=spf1 already exists, edit it rather than adding a second one.
• Save; the Hetzner name servers serve the record immediately.

Typical mistakes at Hetzner

• Two TXT records with v=spf1: both are ignored. Always edit the existing one.
• The record sits on www or a subdomain instead of the apex domain.
• Quotation marks typed into the value: the DNS editor adds them itself.
• More than ten lookups after adding further services.

Verify and keep an eye on it

After saving, the change at Hetzner usually applies within minutes. The checker below queries the authoritative name servers and shows right away whether the SPF record is read correctly. DomainWarn keeps checking the record afterwards and alerts you when it changes or disappears, for example after a migration or one click too many in the DNS editor.

Frequently asked questions

Where do I find the SPF value in the Hetzner control panel?

In the email settings of the domain; Hetzner shows the recommended value there. If only Hetzner sends, that value is enough.

How long until the SPF record takes effect?

At Hetzner usually minutes, at the latest once the TTL of the old record has expired. Receivers query the record with every message.