How to Build a Correct SPF Record (and Avoid the 10-Lookup Limit)

An SPF record authorises which servers may send mail for your domain — but it has a hard limit of 10 DNS lookups, and exceeding it causes SPF to fail entirely. Building SPF correctly means authorising every legitimate sender while staying under that limit. See the overview in SPF, DKIM and DMARC explained.

Anatomy of an SPF record

An SPF record is a single TXT record at your domain's root, starting with v=spf1 and ending with an "all" mechanism. Common mechanisms:

ip4: / ip6: — authorise specific IP addresses or ranges. These cost no DNS lookup.
a / mx — authorise the domain's A or MX hosts. Each costs a lookup.
include: — authorise another provider's SPF (like a mail service). Each costs a lookup, and its own includes count too.

The all mechanism

-all (hard fail) — anything not listed is unauthorised. The strongest, recommended once you are confident your record is complete.
~all (soft fail) — treat unlisted senders with suspicion but not outright rejection. A safe stepping stone.
Avoid +all — it authorises everyone, defeating the purpose entirely.

The 10-lookup limit

Every include, a, mx, ptr and exists mechanism triggers a DNS lookup, and nested includes count cumulatively. Go over 10 and SPF returns a permerror — which many receivers treat as a failure. This is the single most common SPF problem.

Staying under the limit

Prefer ip4:/ip6: where you know the IPs — they cost nothing.
Remove includes for services you no longer use.
Flatten — replace an include with the actual IP ranges it resolves to (accepting that you must update them if the provider's IPs change).
Consolidate senders where possible.

One record only

A domain must have exactly one SPF TXT record. Two SPF records is invalid and breaks SPF. Verify yours with dig TXT.

Frequently asked questions

What counts toward the 10-lookup limit?

Mechanisms that require DNS resolution: include, a, mx, ptr and exists — plus the lookups inside any included record. Flat ip4: and ip6: entries cost nothing, which is why they help you stay under the limit.

Should I end with -all or ~all?

Use ~all while you confirm every legitimate sender is included, then move to -all for full protection. -all tells receivers to treat unlisted senders as unauthorised.

Can I have two SPF records?

No — exactly one SPF TXT record per domain. Multiple SPF records cause a permerror and break SPF. Merge everything into a single record instead.