SPF record allowed per domain
DNS lookups: the hard limit you can't cross
The strict ending that treats fakes as fakes
A public list of who can send as you
SPF stands for Sender Policy Framework. It’s a single line of text (a TXT record) published in your domain’s DNS, the public address book of the internet. That record names the mail servers and services allowed to send email as your domain: your email provider, your marketing platform, your invoicing tool, your helpdesk, and so on.
When a receiving server gets a message claiming to be from you, it looks up your SPF record and asks a simple question: did this actually come from a server on the approved list? If yes, the message passes SPF. If it came from somewhere you never authorised, that’s a red flag, and exactly the kind of impersonation SPF exists to expose.
A real record, broken down
v=spf1 include:_spf.google.com include:sendgrid.net ip4:198.51.100.20 -all
v=spf1: marks it as an SPF recordinclude:: trusts another service’s own list (here, Google and SendGrid)ip4:/ip6:: a specific server address you allowaandmx: allow the servers named in your other DNS records-all: everything else is not allowed
How a check actually plays out
SPF is built from small building blocks called mechanisms. Each one is a way of saying “these servers are mine.” The receiver reads them left to right until it finds one that matches the sending server, or runs out and falls back to the ending. The ending is the part that decides what an unknown sender means.
The mechanisms
Pieces like include:, a, mx, ip4: and ip6: each describe one set of permitted servers. Most businesses lean on include:, which hands the work to a provider’s own published list so it stays current when they add servers.
-all (strict)
A hard fail. It says “if the sender isn’t on my list, it’s not me: treat it as a fake.” This is what real protection looks like, and what lets DMARC act with confidence.
~all (soft fail)
A gentler “probably not me, but don’t block it.” Useful while you’re still finding every sender, but on its own it protects very little; the goal is to tighten to -all once you’re sure.
SPF only gets 10 lookups, and they run out fast
Here’s the catch that breaks more domains than any other. To stop SPF being abused to hammer DNS, the standard allows a receiver only 10 DNS lookups while evaluating your record. Every include: you add (for your email host, your CRM, your support desk, your newsletter tool) quietly eats into that budget. Some single includes use several lookups all on their own.
Cross the line and SPF doesn’t bend: it breaks. The whole record returns a permerror, and many receivers treat that as no SPF at all. The worst part: it fails silently. Your mail may keep flowing for a while, your record looks fine to the eye, and nobody notices until deliverability slips or someone starts spoofing you through the gap.
Why the limit is so easy to blow
- Each
include:can cost more than one lookup - Providers change their own lists: your count drifts without you touching a thing
- Adding one new tool can be the include that tips you over
- A
permerroris invisible unless something is watching for it
What “good” looks like
One accurate record that covers every service you genuinely send from, comfortably under the 10-lookup limit, ending in a strict -all so unlisted servers are treated as fakes. The hard part isn’t writing it once; it’s keeping it correct as your sending services come and go. That ongoing watch is exactly what DMARCER does for you.
How DMARCER keeps you safe
DMARCER reads your SPF record the way a receiver would and counts your DNS lookups for you, so you know exactly how much headroom you have before the limit bites, instead of finding out the hard way. It flags a record that’s drifting toward the edge, or one that’s already in permerror, in plain English.
And when you genuinely have too many senders to fit, you don’t have to choose which to drop. DMARCER offers hosted SPF flattening: it serves a tidy, maintained record that resolves your senders down to a form that stays safely under the limit, and keeps it current as providers change behind the scenes.
- Live count of your DNS lookups against the limit of 10
- Early warning before you tip into
permerror - Hosted SPF flattening to stay under the limit automatically
- Checks that your ending is a strict
-all, not just~all - Continuous monitoring as your senders change over time
Keep exploring
Hosted SPF →
Flatten your record and stay under the 10-lookup limit for good.
SPF checker →
Check your record and its lookup count in seconds, free.
DMARC →
The policy that turns an SPF result into real protection.
See where your SPF really stands
Run a free check to see your record, your lookup count, and whether you’re one include away from failing silently.
Check your domain