How it works · SPF

SPF: who's allowed to send as you

SPF is the published list of mail servers permitted to send on your domain's behalf. Receiving servers check it to spot mail coming from somewhere it shouldn't.

1

SPF record allowed per domain

10

DNS lookups: the hard limit you can't cross

-all

The strict ending that treats fakes as fakes

A public list of who can send as you

SPF stands for Sender Policy Framework. It’s a single line of text (a TXT record) published in your domain’s DNS, the public address book of the internet. That record names the mail servers and services allowed to send email as your domain: your email provider, your marketing platform, your invoicing tool, your helpdesk, and so on.

When a receiving server gets a message claiming to be from you, it looks up your SPF record and asks a simple question: did this actually come from a server on the approved list? If yes, the message passes SPF. If it came from somewhere you never authorised, that’s a red flag, and exactly the kind of impersonation SPF exists to expose.

A real record, broken down

v=spf1 include:_spf.google.com include:sendgrid.net ip4:198.51.100.20 -all

  • v=spf1: marks it as an SPF record
  • include:: trusts another service’s own list (here, Google and SendGrid)
  • ip4: / ip6:: a specific server address you allow
  • a and mx: allow the servers named in your other DNS records
  • -all: everything else is not allowed

How a check actually plays out

SPF is built from small building blocks called mechanisms. Each one is a way of saying “these servers are mine.” The receiver reads them left to right until it finds one that matches the sending server, or runs out and falls back to the ending. The ending is the part that decides what an unknown sender means.

The mechanisms

Pieces like include:, a, mx, ip4: and ip6: each describe one set of permitted servers. Most businesses lean on include:, which hands the work to a provider’s own published list so it stays current when they add servers.

-all (strict)

A hard fail. It says “if the sender isn’t on my list, it’s not me: treat it as a fake.” This is what real protection looks like, and what lets DMARC act with confidence.

~all (soft fail)

A gentler “probably not me, but don’t block it.” Useful while you’re still finding every sender, but on its own it protects very little; the goal is to tighten to -all once you’re sure.

The trap almost everyone hits

SPF only gets 10 lookups, and they run out fast

Here’s the catch that breaks more domains than any other. To stop SPF being abused to hammer DNS, the standard allows a receiver only 10 DNS lookups while evaluating your record. Every include: you add (for your email host, your CRM, your support desk, your newsletter tool) quietly eats into that budget. Some single includes use several lookups all on their own.

Cross the line and SPF doesn’t bend: it breaks. The whole record returns a permerror, and many receivers treat that as no SPF at all. The worst part: it fails silently. Your mail may keep flowing for a while, your record looks fine to the eye, and nobody notices until deliverability slips or someone starts spoofing you through the gap.

Why the limit is so easy to blow

  • Each include: can cost more than one lookup
  • Providers change their own lists: your count drifts without you touching a thing
  • Adding one new tool can be the include that tips you over
  • A permerror is invisible unless something is watching for it

What “good” looks like

One accurate record that covers every service you genuinely send from, comfortably under the 10-lookup limit, ending in a strict -all so unlisted servers are treated as fakes. The hard part isn’t writing it once; it’s keeping it correct as your sending services come and go. That ongoing watch is exactly what DMARCER does for you.

How DMARCER keeps you safe

DMARCER reads your SPF record the way a receiver would and counts your DNS lookups for you, so you know exactly how much headroom you have before the limit bites, instead of finding out the hard way. It flags a record that’s drifting toward the edge, or one that’s already in permerror, in plain English.

And when you genuinely have too many senders to fit, you don’t have to choose which to drop. DMARCER offers hosted SPF flattening: it serves a tidy, maintained record that resolves your senders down to a form that stays safely under the limit, and keeps it current as providers change behind the scenes.

  • Live count of your DNS lookups against the limit of 10
  • Early warning before you tip into permerror
  • Hosted SPF flattening to stay under the limit automatically
  • Checks that your ending is a strict -all, not just ~all
  • Continuous monitoring as your senders change over time

Keep exploring

Hosted SPF →

Flatten your record and stay under the 10-lookup limit for good.

SPF checker →

Check your record and its lookup count in seconds, free.

DMARC →

The policy that turns an SPF result into real protection.

See where your SPF really stands

Run a free check to see your record, your lookup count, and whether you’re one include away from failing silently.

Check your domain
Free domain check

Check your domain security

See how your domain's security compares to your competitors.