What it is
SPF is a single TXT record on your domain that names the servers permitted to send mail as you. When a receiving server gets a message claiming to be from your domain, it looks up that record and checks whether the connecting server is on the list.
A minimal record looks like v=spf1 include:_spf.google.com -all. The include: delegates to Google’s own list of sending servers, and -all says everything else should be rejected.
Why it exists
SMTP was designed with no way to verify who a message was from. Anyone can connect to a mail server and claim to be sending as your domain. SPF was the first widely adopted attempt to close that hole, by letting a domain owner publish who is actually authorised.
The ten-lookup limit
This is the part that catches people. SPF allows a maximum of ten DNS lookups when a receiver evaluates your record. Every include: costs one, and every include nested inside those costs another. Google, a sending tool, a CRM and a helpdesk together will usually push you over.
Past ten lookups, SPF returns permerror. Depending on the receiver, that can be treated as an outright failure. Nothing warns you and the record still looks perfectly reasonable in a text editor, which is why this can sit broken for months.
What -all, ~all and +all mean
-all is hard fail: reject anything not listed. ~all is soft fail: accept but mark suspicious. +all authorises the entire internet to send as you and should never appear in a record.
Most domains sit on ~all because it feels safer. It is not — it tells receivers you are not confident about your own sender list. Move to -all once every legitimate sender is accounted for.
Check yours
These run free in your browser. Nothing you type reaches a server.
Common questions
Can I have two SPF records?
No. A domain must have exactly one SPF TXT record. Two records is a permanent error and receivers will treat authentication as broken. Multiple senders go into one record as multiple include: mechanisms.
Does SPF alone protect my domain?
No. SPF validates the envelope sender, not the From address your recipient actually sees. Someone can pass SPF on their own domain while displaying yours in the From field. That gap is what DMARC alignment closes.
What happens if I go over ten lookups?
Receivers return permerror, and many treat that as a fail. Fix it by removing includes for services that no longer send, consolidating where possible, or moving a service onto a subdomain with its own SPF record.
Related concepts
If this is the thing going wrong
The pages explain it. If you would rather it was simply fixed, that is the work I do.