What is SPF?
A published list of the servers allowed to send for your domain, and the ten-lookup limit that quietly breaks a lot of them.
SPF is a TXT record listing the servers allowed to send mail for your domain. Defined in RFC 7208.
Reading one
v=spf1 include:_spf.google.com ip4:203.0.113.10 -all
v=spf1 opens every SPF record. Then a list of things that authorise a sender, then a policy for everything not listed.
include: pulls in another domain’s record, which is how you authorise a provider. ip4: and ip6: authorise addresses directly. a and mx authorise whatever your A or MX records point at.
-all at the end means everything else fails. ~all means everything else is suspicious but probably deliverable. The all mechanism is always last, and anything after it is ignored.
What SPF proves, and what it does not
SPF checks the envelope sender, the address in the MAIL FROM part of the SMTP conversation. Your recipient never sees that address.
So SPF on its own does not stop somebody putting your domain in the From header. It proves a particular server was allowed to send for a particular envelope domain, which is narrower than most people assume. Tying it to the visible address is DMARC’s job.
The ten lookup limit
This is where most SPF records go wrong.
Each include, a, mx, ptr, exists and redirect costs one DNS lookup, and the lookups inside your includes count against the same total. Ten is the maximum, from RFC 7208 section 4.6.4. Past it, receivers must return a permanent error, and SPF fails for every message you send.
A record with four entries can be over the limit because one vendor’s record contains six of its own. You cannot tell by looking at it, which is why the checker expands the whole chain and shows the cost of each branch. If you are over, how to get back under.
Two rules people break
Never publish two SPF records. Two v=spf1 records at the same name is a permanent error and receivers treat SPF as broken entirely. Merge them.
Never use +all. It authorises every server on the internet to send as you. It appears when somebody is trying to make an error go away, and it is worse than having no record.
Check yours
Run the SPF checker for the exact lookup count and the chain that produced it. Building a first record: the generator.
Common questions
What does an SPF record look like?
A TXT record at your domain starting v=spf1, then the servers you authorise, then a policy for everything else. For example v=spf1 include:_spf.google.com -all authorises Google Workspace and rejects everything else.
What is the difference between ~all and -all?
~all is softfail: mail from an unlisted server is marked suspicious but usually delivered. -all is hardfail: it should be refused. -all is the goal, but only once you are certain every legitimate sender is listed.
Can I have two SPF records?
No. Two v=spf1 records at the same name is a permanent error and receivers treat SPF as broken entirely. If you need to authorise more senders, merge them into one record.
Does SPF survive forwarding?
No, and that is its main weakness. When a message is forwarded the sending IP changes to the forwarder's, which is not in your record, so SPF fails. DKIM survives forwarding, which is why you need both.
Run the test on your own domain
Read next
Email authentication, explained by what each part proves
GuideThree records, three different jobs, and only one of them stops somebody sending mail in your name. Here is what each proves and the order to fix them in.
SPF: too many DNS lookups
Ten is the limit, the lookups inside your includes count against it, and past ten SPF fails for every message you send. Here is how to get back under.
What is DKIM?
A cryptographic signature on every message you send, and the only identifier that survives being forwarded.
Every fix on this site is yours to implement. If you would rather someone did it, I take this work directly.