How to Add an SPF Record in DigitalOcean: Step-by-Step Guide

DigitalOcean is a popular cloud hosting platform, and its built-in DNS management makes it easy to add an SPF record for your domain. This guide walks you through every step in DigitalOcean's Control Panel, from locating the DNS settings to verifying that your record is live. No technical experience required. For background on SPF records, see our complete SPF guide.

Before You Start

You need a few things in place:

1. Your DigitalOcean account login. You need access to the account where your domain's DNS is managed.
2. Your domain must be added to DigitalOcean. Unlike traditional registrars, DigitalOcean is primarily a hosting provider. Your domain needs to be added to DigitalOcean's networking panel, and your domain's nameservers must point to DigitalOcean (ns1.digitalocean.com, ns2.digitalocean.com, ns3.digitalocean.com) for DNS records to work.
3. Your SPF record value. This is the text string you will add. If you are not sure what it should contain, SPF Creator can build the correct record based on the email services you use.

A typical SPF record looks like this:

v=spf1 include:_spf.google.com ~all

Your record will be different depending on what services send email for your domain — Google Workspace, Microsoft 365, SendGrid, Mailchimp, and so on. See SPF record examples for common configurations, or check the SPF syntax guide for details on each mechanism.

Step-by-Step: Adding an SPF Record in DigitalOcean

Important: DigitalOcean Is Not a Registrar

This is a key detail that catches many people. DigitalOcean does not sell domain names. You buy your domain from a registrar like Namecheap, GoDaddy, or Porkbun, and then you can optionally point that domain's nameservers to DigitalOcean so that DigitalOcean manages the DNS.

If your nameservers are still pointing to your registrar, adding DNS records in DigitalOcean will have no effect. To check, look at your domain's nameserver settings at your registrar. They should show:

• ns1.digitalocean.com
• ns2.digitalocean.com
• ns3.digitalocean.com

If your nameservers point somewhere else (like Cloudflare, your registrar's default, etc.), you need to add the SPF record at that DNS provider instead — not in DigitalOcean.

Editing an Existing SPF Record

If you already have an SPF record and need to add a new email service, do not create a second SPF record. Instead, find the existing TXT record starting with v=spf1 in your domain's DNS records list, click the More menu (three dots) on the right, and select Edit Record. Add your new include before the ~all at the end, then click Save Record.

Example: Adding SendGrid to an existing Google Workspace SPF record.

Before:

v=spf1 include:_spf.google.com ~all

After:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

DNS Propagation Time

After saving your record, it does not appear everywhere instantly. DNS changes need to propagate across the internet:

• DigitalOcean's own servers: Usually updated within a few minutes
• Most DNS resolvers: 30 minutes to 2 hours
• Full global propagation: Up to 48 hours in rare cases

Since you set the TTL to 3600 seconds (one hour), most resolvers will pick up the change within an hour or two. If you want faster propagation while testing, you can temporarily set the TTL to a lower value like 300 (five minutes).

Common Mistakes

Adding the domain in DigitalOcean but not updating nameservers. If your nameservers still point to your registrar, the DNS records you create in DigitalOcean will be ignored. This is the most common reason an SPF record "doesn't work" in DigitalOcean.

Creating a second SPF record instead of editing. You can only have one SPF record per domain. If you need to add a service, edit the existing record to include it.

Entering the full domain as the hostname. In the Hostname field, enter @ for your root domain — not yourdomain.com. Entering the full domain name may create the record on a subdomain like yourdomain.com.yourdomain.com.

Forgetting the ~all or -all at the end. Every SPF record needs an all mechanism that tells receiving servers what to do with unlisted senders.

Complete Your Email Authentication

SPF is one part of email authentication. For the best deliverability and protection against spoofing, you should also set up:

• DKIM — Adds a cryptographic signature to your emails. Check your DKIM setup with DKIM Test.
• DMARC — Tells receiving servers what to do when SPF or DKIM fail. Check yours with DMARC Record Checker.

Setting up all three gives you the strongest email authentication. You can verify your complete setup with the Email Deliverability Checker.

References

• RFC 7208: Sender Policy Framework (SPF) — The current SPF specification
• DigitalOcean: How to manage DNS records — Official DigitalOcean DNS documentation