# How to set up an SPF record (and stay under 10 lookups)

> SPF lists the servers allowed to send mail for your domain. One TXT record, every sender included, 10 DNS lookups at most, ending in ~all or -all.

Security · HTML version: https://getreport.app/learn/spf-record

## SPF record

Passing looks like: The domain publishes an SPF record.

**Why it matters.** SPF tells receiving servers which servers may send mail for your domain. Without it, spoofed mail is harder to reject and your real mail is more likely to land in spam.

**How to fix it.**

1. Add one TXT record at the domain root that starts with v=spf1, includes each service that sends for you (your mailbox provider, newsletter tool, shop) and ends with ~all.
2. Keep it to one record; two SPF records make both invalid.

## SPF syntax and lookup limit

Passing looks like: SPF syntax and lookup limit passes.

**Why it matters.** A broken SPF record counts as no record at all. The most common break is more than 10 DNS lookups once every include is followed, which makes receivers give up with a "permerror".

**How to fix it.**

1. Remove include: entries for services you no longer use, and merge or flatten the rest until the count is 10 or less.
2. Replace mx, a and ptr mechanisms with the ip4 or ip6 ranges they stand for when you are close to the limit.

## SPF catch-all rule

Passing looks like: SPF catch-all rule passes.

**Why it matters.** The last term of an SPF record decides what happens to mail from servers you did not list. +all allows everyone, ?all says nothing, and a missing all leaves receivers guessing.

**How to fix it.**

1. End the record with ~all (soft fail) while you check your senders, then -all (fail) once every sender is listed.

Check your own page: https://getreport.app/