What Is an SPF Record?
Definition
An SPF record (Sender Policy Framework) is a DNS text record that lists the servers allowed to send email for your domain. When a message arrives, the receiving server checks whether the sending IP is on that list.
SPF checks the envelope sender, the hidden Return-Path address, not the From address your recipient sees. That is why SPF alone cannot stop someone faking your visible From line, and why DMARC exists.
Why an SPF Record Matters
SPF is the cheapest authentication you can add: one DNS record, no keys, no software. Leave it out and receivers have one less reason to trust your mail, and Gmail can mark unauthenticated messages as spam or reject them with a 5.7.26 error.
The bigger risk is an SPF record that looks fine and quietly fails. A broken record returns an error on every message, and nothing in your sending tool reports it.
SPF lookup count
include + a + mx + ptr + exists + redirect, nested ones included. Over 10 = permanent error
How an SPF Record Works
An SPF check happens before the message body is even read.
- Declare. Your server sends the message with an envelope sender at your domain.
- Look up. The receiver fetches the TXT record that starts
v=spf1at that domain. - Match. It reads the record left to right and stops at the first entry that matches the sending IP.
- Decide. The result is pass, fail, softfail, neutral, or an error, and the receiver weighs it with everything else it knows.
SPF Record Syntax
A working record for a company on Google Workspace that also sends through one marketing tool looks like this:
Starter SPF record
v=spf1 include:_spf.google.com include:servers.mcsv.net ~all
Why it works: each include hands the check to a provider who keeps their own IP list current, and ~all marks everything else as suspicious without bouncing it outright.
| Part | What it does | Costs a lookup |
|---|---|---|
| v=spf1 | Marks the record as SPF, must come first | No |
| ip4: / ip6: | Allows one IP or a range | No |
| include: | Pulls in another domain’s SPF list | Yes, plus its own lookups |
| a / mx | Allows your website or mail server IPs | Yes |
| ptr | Reverse DNS match | Yes, and RFC 7208 says do not use it |
| all | Catches everything not matched before it | No |
What ~all and -all Mean
The symbol before all sets what happens to mail from unlisted servers. -all is a fail, ~all is a softfail, and ?all is neutral, which tells the receiver nothing. Avoid +all, because it lets every server on the internet send as you.
In practice receivers rarely bounce on SPF alone. Once DMARC is in place, it decides what happens to failing mail, so ~all plus DMARC is a common and safe setup.
SPF 10-Lookup Limit
RFC 7208 says implementations “MUST limit the total number of those terms to 10”, counting every include, a, mx, ptr, exists and redirect. Go over, and the result is a permanent error, which most receivers treat like having no SPF at all.
Includes are the trap, because the lookups inside them count too. We checked live DNS on November 9, 2026 to see what common includes really cost:
| Include | Provider | Lookups it uses |
|---|---|---|
| _spf.google.com | Google Workspace | 1 |
| spf.protection.outlook.com | Microsoft 365 | 1 |
| servers.mcsv.net | Mailchimp | 1 |
| _spf.hubspotemail.net | HubSpot | 1 |
| sendgrid.net | SendGrid | 2 |
| _spf.salesforce.com | Salesforce | 2 |
| mailgun.org | Mailgun | 5 |
Worked Example: Counting Your Lookups
Say your record includes Google Workspace (1), Mailgun (5), SendGrid (2) and Salesforce (2). That adds up to exactly 10, so SPF still passes.
Now marketing adds HubSpot. The count goes to 11 and every message fails SPF with a permanent error, including mail from Google, which was never the problem. Nothing tells you this happened; you find out when replies drop.
Providers change these numbers when they restructure their records, so recount whenever you add a tool. There is also a second limit: RFC 7208 says lookups that return nothing, called void lookups, should be capped at two, which catches records still pointing at a tool you cancelled.
SPF Record Mistakes and Fixes
| Mistake | Why it happens | Fix |
|---|---|---|
| Two SPF records | A new tool’s setup guide says add a record | Merge into one; two records is a permanent error |
| Over 10 lookups | Includes added over years, never removed | Remove unused tools, swap includes for ip4 ranges you control |
| Dead includes | Cancelled tool still listed | Delete it; it can also trip the void limit |
| Expecting subdomains to inherit | SPF looks like a domain-wide setting | Publish a record on every subdomain that sends |
| Using the SPF record type | Old guides mention DNS type 99 | Use TXT only; RFC 7208 retired type 99 |
SPF flattening tools replace includes with the IP ranges behind them to get under 10 lookups. It works, but you now own those ranges. When a provider adds servers, your flattened record is out of date until the tool refreshes it, so pick one that updates automatically.
Why SPF Alone Is Not Enough
SPF has two gaps. It checks the hidden envelope sender rather than the From line, and it fails whenever a message is forwarded, because the forwarding server is not on your list.
DKIM covers the forwarding gap by signing the message itself, and DMARC covers the From gap by requiring alignment. Google requires all three for anyone sending more than 5,000 messages a day to Gmail, and the same setup protects smaller senders from the slow reputation damage that limits how many emails you can send before spam filters react.
Bottom Line
An SPF record tells receivers which servers may send mail for your domain, and it is checked before your message is even read.
Keep exactly one record per sending domain, stay under 10 lookups, and recount every time someone adds a tool. Then add DKIM and DMARC, because SPF on its own cannot protect your From address or survive forwarding.
FAQs
1- What does an SPF record do?
It lists the servers allowed to send email for your domain. Receiving servers compare the sending IP against that list and use the result as one input in deciding whether to trust the message.
2- Can a domain have two SPF records?
No. RFC 7208 does not allow multiple SPF records for one name, and receivers return a permanent error. Merge every sender into a single record.
3- What happens if I go over 10 DNS lookups?
SPF returns a permanent error for every message, which most receivers treat as having no valid SPF. Mail does not always bounce, but it loses the authentication your domain needs.
4- Should I use ~all or -all?
With DMARC in place, either works, because DMARC decides what happens to failing mail. Without DMARC, -all is stricter. Never use +all.
5- Do subdomains use the main domain’s SPF record?
No. SPF is checked on the exact domain in the envelope sender, so each subdomain that sends mail needs its own record.
6- How do I check my SPF record?
Send a message to Gmail and choose Show original, which shows SPF as PASS or FAIL. To see the record itself, look up the TXT records for your domain with any DNS lookup tool.
7- Is SPF required for Gmail?
Google requires all senders to use SPF or DKIM, and anyone sending more than 5,000 messages a day to Gmail accounts must use both, plus DMARC.