What SPF does
SPF (RFC 7208) is a TXT record at the domain apex that lists the servers allowed to send mail using the domain in the envelope sender. Receivers look it up on every message; if the sending IP is not listed the result is fail (with -all) or softfail (with ~all).
Common mistakes we catch
- More than 10 DNS lookups (include, a, mx, ptr, exists, redirect) — this is a permerror and SPF silently fails for every message.
- Two SPF records — a permerror too (RFC 7208 §4.5): no message passes SPF.
- +all or ?all — authorises everyone.
- Includes that point at domains with no SPF ("void lookups").
SPF checker: questions
How many DNS lookups can an SPF record have?+
Ten. RFC 7208 §4.6.4 allows at most 10 of the terms that trigger DNS lookups, the include, a, mx, ptr and exists mechanisms and the redirect modifier, counting those inside nested includes; ip4, ip6 and all need none. A record that needs more returns permerror, which DMARC counts as SPF not passing. The checker follows every include and redirect and shows the total.
How do I fix the SPF too many DNS lookups error?+
Reduce the lookups the record needs. Remove includes for services you no longer use, replace a and mx with the ip4 or ip6 addresses they stand for, and have a high-volume sender use a subdomain such as bounce.example.com as its Return-Path; that subdomain gets its own SPF record and its own limit of 10. Flattening includes into IP lists also works but breaks when a provider changes its addresses.
Can a domain have two SPF records?+
No. When a domain publishes more than one v=spf1 TXT record, RFC 7208 §4.5 makes SPF return permerror for every message, so none of its mail passes SPF. Merge all senders into one record, such as v=spf1 include:_spf.google.com include:mail.zendesk.com -all, and delete the other. EmailSecOps monitoring re-checks SPF at least once a day and alerts you when the record changes.
What is an SPF void lookup?+
A DNS lookup during SPF evaluation that returns no records, either an empty answer or NXDOMAIN. RFC 7208 §4.6.4 says to allow at most two, so a third makes the result permerror. They usually come from an include, a or mx term naming a domain that no longer exists. Separately, an include whose domain publishes no SPF record at all is a permerror on its own (RFC 7208 §5.2).
What do +all and ?all mean in SPF?+
+all passes every server on the internet, so anyone can send mail that passes SPF as your domain. ?all returns neutral for servers you have not listed, which offers no protection, and a record with no all mechanism behaves the same way. The checker flags +all as critical and ?all as high; end the record with -all, or ~all while you confirm your senders.
Why does SPF fail for forwarded email?+
Because the forwarding server sends from its own IP address, which your SPF record does not list. Receivers then see fail or softfail, or a pass for the forwarder's domain if it rewrites the envelope sender, and that does not align with your From domain. DKIM signatures usually survive forwarding, so sign all mail with DKIM for your own domain.