SPF Records Explained: Setup, Limits and Common Errors

What an SPF record authorises, why the 10-lookup limit breaks it, and how to add a sender without knocking out mail you already send.

An SPF record lists the servers allowed to send email for a domain. Receivers look it up when a message arrives. If the sending server is not in that list, SPF fails for that message. A passing SPF result does not mean the email will reach the inbox. It means this server was allowed to try.

Quote this if you need a definition: SPF is a DNS record that names the hosts permitted to send mail using your domain in the envelope.

How it works

You publish a TXT record on the domain. It starts with v=spf1 and ends with a mechanism such as -all or ~all. Include, a, mx, and ip4 mechanisms add senders. Each include can trigger further DNS lookups. The specification stops evaluation after 10 lookups. Past that, receivers return a permanent error rather than a soft pass.

Add a new tool by putting its include or its IP in the same record, then send a test from that tool and from the mail you already use. If the old mail starts failing, the new include pushed you over the lookup limit or replaced a mechanism you still needed.

Common mistakes

Two SPF TXT records on one domain. Receivers do not merge them into a polite union. A record copied from a vendor that also contains -all, pasted beside the record you already had. Flattening includes by hand and then forgetting to update them when the vendor changes IPs.

Sendblox does not publish your DNS. It sends through the infrastructure you connect. If that infrastructure is not in SPF, the draft never had a chance, however careful the copy was.

Before you publish a change for SPF record, write down the date, the record you edited, and the one message you used as a test. A week later, check whether that test still matches production. Provider rules, DNS includes, and CRM fields all move. A page that was true in general can be wrong on your domain if nobody looked again. Keep the send small until that check is dull. One contact, one objective, a person reading the draft. If the test fails, stop the campaign. Do not widen it to see whether a larger list forgives a broken setup.