SPF Record Lookup

What is an SPF record?

An SPF (Sender Policy Framework) record is a DNS TXT record that lists which mail servers are authorized to send email on behalf of your domain. When a receiving server gets an email from your domain, it checks SPF to confirm the sending IP is allowed. A missing or misconfigured SPF record increases the chance of your email going to spam.

The 10 DNS lookup limit

SPF has a hard limit of 10 DNS lookups during evaluation. Each include:, a, mx, ptr, exists:, and redirect= mechanism counts as one lookup (and the included records may add more). If your SPF exceeds 10 lookups, the evaluation returns permerror, which many providers treat as a fail.

Common ways to stay under the limit:

• Replace include: chains with direct ip4: and ip6: ranges where possible.
• Remove sending services you no longer use.
• Use an SPF flattening service for very complex setups.

SPF all mechanisms explained

• -all - Fail. Mail from unlisted senders should be rejected. Strictest option.
• ~all - SoftFail. Mail from unlisted senders may be flagged but is not rejected. Most common starting point.
• +all - Pass. Anyone can send. Do not use this.
• ?all - Neutral. No policy statement. Essentially useless.

Common SPF mistakes

• Multiple SPF records: you can only have one SPF TXT record per domain. Having two causes permerror.
• Too many includes: quickly exceeds the 10 lookup limit, especially with marketing platforms.
• Using +all: allows any server to send, completely defeating the purpose.
• Missing include for third-party senders: transactional email services like SendGrid need include:sendgrid.net.
• SPF passes but DMARC fails: SPF alignment requires the envelope-from domain to match the From header domain.

FAQ

Do I need SPF if I have DKIM?

DMARC passes if either SPF or DKIM is aligned. But SPF provides a fast first-pass check for many receivers and is cheap to configure. Sending without SPF means some providers will flag your mail even if DKIM is perfect.

My SPF record has include: entries - do they count toward the 10 limit?

Yes. Each include: costs one lookup, and the mechanisms inside the included record also count toward the same limit. So include:mailchimp.com adds 1 lookup, but Mailchimp's own SPF record may contain more includes that add additional lookups.

Can I have two SPF records?

No. Only one SPF TXT record is allowed per domain. If you have two, the result is permerror during evaluation. Combine all your sending sources into a single record.