Build a valid SPF record from the senders you authorise.
Tick every service that sends mail on your domain's behalf, set the policy, copy the record. The tool warns if you cross the SPF 10-DNS-lookup limit, which is the single most common reason an SPF record silently fails.
yourdomain.com
v=spf1 mx ~all
Publish as a TXT record on the root of your domain (not a subdomain). Allow ~24h for propagation, then verify with our SPF checker.
The tool counts DNS lookups as you add senders, because the 10-lookup ceiling is the failure that voids a record silently — every include:, a, mx and exists: counts, including the ones nested inside your providers' records.
It defaults to ~all. Stay there until your DMARC reports confirm every legitimate sender is covered, then consider -all.
As a TXT record on the root of your domain (the same name where you set your DMARC at _dmarc.yourdomain.com lives one level deeper).
No. Multiple v=spf1 records is a misconfiguration — receivers treat it as PermError. Merge everything into one record.
SPF caps DNS lookups at 10 during evaluation. Each include:, a, mx, exists: mechanism counts. Crossing it returns PermError — the same as having no SPF.
~all (soft fail) for most senders. -all (hard fail) only after DMARC reports confirm every legitimate sender is covered, otherwise legitimate mail will bounce.
Use SPF flattening: a service rewrites all your include: mechanisms into a single ip4: list. SieveGuard's Domain Health add-on flags lookup-limit overflows automatically as part of the daily health check.
SieveGuard's Domain Health add-on tracks SPF, DKIM, DMARC + MX on every domain you ingest. Drift alerts when a record changes, lookup-limit warnings when you add too many ESPs. Free during your trial.