What is SPF?

How receivers use it

When a server delivers a message, the receiver looks up the SPF record of the domain in the return-path (the envelope sender, not the visible From) and checks whether that server is on the list.

Anatomy of a record

v=spf1 ip4:203.0.113.10 include:_spf.google.com ~all

• ip4 and ip6 list your own servers.
• include pulls in another provider's list.
• a and mx authorize the servers behind your A or MX records.
• The all at the end covers everything else.

The 10-lookup limit

Evaluating SPF may trigger at most 10 DNS lookups, counting every include, a, mx, ptr, exists and redirect, including the ones nested inside included records. Beyond 10, the result is a permanent error and SPF fails for all your mail. Adding one more marketing tool is often what tips a record over the edge.

Ending with -all or ~all

~all (soft fail) marks unlisted servers as suspicious; -all (fail) marks them as unauthorized. With DMARC in place either works, because DMARC makes the final decision. Avoid ?all, which says nothing, and never use +all, which authorizes the whole internet.

Inspect your record with the SPF checker or build a clean one with the SPF generator.