Build a valid SPF record from the senders you authorise.
Tick every service that sends mail on your domain's behalf, set the policy, copy the record. The tool warns if you cross the SPF 10-DNS-lookup limit, which is the single most common reason an SPF record silently fails.
yourdomain.com
v=spf1 mx ~all
Publish as a TXT record on the root of your domain (not a subdomain). Allow ~24h for propagation, then verify with our SPF checker.
SPF (Sender Policy Framework) authorises which servers may send mail on behalf of your domain. When a message arrives, the receiving server compares the envelope-from domain against the IP that delivered it; if the IP isn't covered by the SPF record, the message fails SPF.
SPF on its own doesn't reject mail — DMARC does. But mailbox providers downrank SPF-failing mail aggressively, so a misconfigured SPF directly tanks your inbox placement even without a DMARC policy.
The single biggest SPF footgun is the 10-DNS-lookup limit. Every include:, a, mx, and exists: mechanism counts. Stack too many ESP includes and your record returns PermError — at which point most receivers treat it as if SPF didn't exist. This tool counts the lookups for you in real time.
Use ~all (soft fail) until you're confident every legitimate sender is covered. Only escalate to -all (hard fail) once your DMARC reports confirm no legitimate mail is being dropped.
As a TXT record on the root of your domain (the same name where you set your DMARC at _dmarc.yourdomain.com lives one level deeper).
No. Multiple v=spf1 records is a misconfiguration — receivers treat it as PermError. Merge everything into one record.
SPF caps DNS lookups at 10 during evaluation. Each include:, a, mx, exists: mechanism counts. Crossing it returns PermError — the same as having no SPF.
~all (soft fail) for most senders. -all (hard fail) only after DMARC reports confirm every legitimate sender is covered, otherwise legitimate mail will bounce.
Use SPF flattening: a service rewrites all your include: mechanisms into a single ip4: list. SieveGuard's Domain Health add-on flags lookup-limit overflows automatically as part of the daily health check.
SieveGuard's Domain Health add-on tracks SPF, DKIM, DMARC + MX on every domain you ingest. Drift alerts when a record changes, lookup-limit warnings when you add too many ESPs. Free during your trial.