How to set up an SPF record (and stay under 10 lookups)
SPF lists the servers allowed to send mail for your domain. One TXT record, every sender included, 10 DNS lookups at most, ending in ~all or -all.
Check your own domain
Our Email & DNS health tool runs these 3 checks and writes the record to add, free, in seconds.
What a passing site looks like
- The domain publishes an SPF recordfail · −25 ptseffort S
- SPF syntax and lookup limit: passesfail · −15 ptseffort M
- SPF catch-all rule: passeswarning · −4 ptseffort S
1. No SPF record, so anyone can send email as your domain
Why it matters. SPF tells receiving servers which servers may send mail for your domain. Without it, spoofed mail is harder to reject and your real mail is more likely to land in spam.
- Add one TXT record at the domain root that starts with v=spf1, includes each service that sends for you (your mailbox provider, newsletter tool, shop) and ends with ~all.
- Keep it to one record; two SPF records make both invalid.
2. SPF syntax and lookup limit
Why it matters. A broken SPF record counts as no record at all. The most common break is more than 10 DNS lookups once every include is followed, which makes receivers give up with a "permerror".
- Remove include: entries for services you no longer use, and merge or flatten the rest until the count is 10 or less.
- Replace mx, a and ptr mechanisms with the ip4 or ip6 ranges they stand for when you are close to the limit.
3. SPF catch-all rule
Why it matters. The last term of an SPF record decides what happens to mail from servers you did not list. +all allows everyone, ?all says nothing, and a missing all leaves receivers guessing.
- End the record with ~all (soft fail) while you check your senders, then -all (fail) once every sender is listed.