How SPF works
SPF (Sender Policy Framework) is a single TXT record on your domain that lists the servers allowed to send its email. When a message arrives, the receiving server looks up the SPF record of the domain in the message's return path and checks whether the sending server's IP address is on the list.
example.com TXT "v=spf1 include:spf.protection.outlook.com include:_spf.google.com -all"The record is read left to right. Each mechanism matches a set of servers: ip4: and ip6: for addresses, a and mx for your own hosts, and include: to pull in another provider's list. The final all says what happens to everything else.
Common SPF records
- Microsoft 365:
v=spf1 include:spf.protection.outlook.com -all - Google Workspace:
v=spf1 include:_spf.google.com ~all - A domain that never sends email:
v=spf1 -all
Add an include: for every other service that sends as your domain, such as your newsletter, invoicing or help desk tool. Each provider documents the exact value to use.
The endings: -all, ~all, ?all and +all
- -all (fail): anything not listed is unauthorised. The clearest signal you can give.
- ~all (soft fail): unlisted servers are suspicious but not refused. Common and acceptable when DMARC is enforcing, but on its own it is weaker, so our check marks it as low severity.
- ?all (neutral): says nothing either way, which is close to having no SPF.
- +all (pass): authorises every server on the internet to send as you. This is a critical misconfiguration and the first thing to fix.
The 10 DNS lookup limit
To stop SPF being used to flood DNS, receivers will only follow 10 DNS lookups while evaluating a record. Every include, a, mx, exists and redirect counts, and so does every lookup inside the records you include. Go over the limit and SPF returns a permanent error, so your legitimate mail loses SPF entirely.
To get back under it, remove services you no longer use, replace a and mx with the ip4: addresses they point to, and move bulk mail tools to a subdomain such as news.example.com with its own SPF record. Our free check follows your includes and counts the lookups for you.
Mistakes we see often
- Two SPF records. A domain must have exactly one record starting with
v=spf1. Two makes SPF fail; merge them into one. - Leftover includes for providers you left years ago, which waste lookups and authorise servers you don't control.
- Relying on SPF alone. SPF checks the hidden return-path address, not the From address people see. You need DMARC to connect the two, and DKIM for mail that gets forwarded.