Proofpoint SPF record, lookup limit, and DMARC

Proofpoint SPF setup depends on the product, region, and outbound mail route.

For Proofpoint Essentials, tenant connection details can show regional values such as:

v=spf1 include:_spf-us.ppe-hosted.com ~all
v=spf1 include:_spf-eu.ppe-hosted.com ~all

Treat these as examples. Proofpoint changed its SPF recommendation for new customers in February 2024. Its current SPF help directs customers to Connection Details for the value assigned to the tenant. We verified this in August 2026.

In DMARC reports, we often see Proofpoint added to SPF even though the deployment filters only inbound mail. That adds DNS lookups without authenticating any outbound message.

Before you start

Confirm that Proofpoint is actually sending outbound mail for your domain. Many organizations use Proofpoint only for inbound filtering. SPF should authorize services that send mail, not every service that scans inbound mail.

You also need the current outbound SPF value shown in Proofpoint Connection Details. Do not infer it only from the tenant’s region.

Run your domain through the DMARCTrust domain checker before editing DNS so you can see the current SPF record and lookup count.

Step 1: find your current SPF record

In DNS, look for the TXT record at the root domain that starts with v=spf1.

If one exists, edit it. If none exists, our SPF record generator helps you create one with the right Proofpoint include and a live lookup count.

Never publish a separate Proofpoint SPF TXT record beside an existing Google, Microsoft, or Salesforce SPF record. SPF allows one record per domain.

Step 2: add the Proofpoint include

For a tenant whose Connection Details still specifies the US include, the record may look like:

v=spf1 include:_spf-us.ppe-hosted.com ~all

For a tenant whose Connection Details specifies the EU include:

v=spf1 include:_spf-eu.ppe-hosted.com ~all

If Microsoft 365 sends outbound mail through Proofpoint, your combined record might be:

v=spf1 include:spf.protection.outlook.com include:_spf-us.ppe-hosted.com ~all

If Google Workspace also sends directly:

v=spf1 include:_spf.google.com include:_spf-us.ppe-hosted.com ~all

Replace the example with the exact value Proofpoint documents for your tenant.

Proofpoint SPF limit: keep DNS queries under 10

Our SPF checker runs exactly this check: it expands the Proofpoint include and every other nested include over live DNS and counts the total against the limit of 10, so you know how much headroom the record has before you add another sender.

Adding a Proofpoint include starts evaluation of Proofpoint’s SPF policy. The nested terms count toward the same limit as Google, Microsoft, Salesforce, Zendesk, HubSpot, and other senders.

RFC 7208 section 4.6.4 limits one SPF evaluation to 10 DNS-querying terms. Exceeding the limit returns permerror. Count the complete include tree, not only the mechanisms visible in your root record.

Before adding Proofpoint, remove senders you no longer use. If the record is already close to the limit, use DMARC reports to identify which services still send mail.

Step 3: verify real outbound mail

After DNS propagates, send a message that actually routes through Proofpoint.

Check:

• SPF passes for the envelope sender domain.
• There is exactly one SPF record.
• DMARC passes through aligned SPF or aligned DKIM.
• Proofpoint appears correctly in DMARC aggregate reports.

Use DMARCTrust for the DNS check and your DMARCTrust dashboard for real report data.

Common mistakes

Adding Proofpoint when it is inbound-only. If Proofpoint does not send outbound mail for your domain, it does not belong in SPF.

Copying a regional example. Use the value in Connection Details. Do not infer the current record from an older guide or the tenant region alone.

Creating a duplicate SPF record. Merge Proofpoint into the existing SPF record.

Assuming SPF solves DMARC. SPF must align with the visible From domain. If routing changes the return-path domain, DKIM may be the better DMARC path.

What about DKIM?

Proofpoint Essentials can be part of outbound DKIM signing, but the DNS record is not a universal public value. Your tenant or Proofpoint support must provide the DKIM selector and DNS value.

Use the companion guide: Proofpoint DKIM setup.

FAQ

What is the Proofpoint SPF record?

There is no value you should select from region alone. Open Proofpoint Essentials Connection Details and use the current SPF value for the tenant. Some existing tenants use _spf-us.ppe-hosted.com or _spf-eu.ppe-hosted.com.

Should I add Proofpoint to SPF if it only filters inbound mail?

No. SPF authorizes outbound senders. Inbound filtering alone does not require SPF authorization.

Can I have Microsoft 365 and Proofpoint in one SPF record?

Yes. Merge both includes into one SPF TXT record and verify the lookup count.

Should I add Proofpoint IP addresses directly to SPF?

Use the SPF value assigned in Proofpoint Essentials Connection Details. Do not replace it with IP addresses collected from logs or an older article. The tenant value is the configuration Proofpoint tells you to publish.