SPF records explained: mechanisms, qualifiers and the 10-lookup limit

What SPF actually checks

RFC 7208 defines SPF as a check on two identities from the SMTP conversation: the MAIL FROM address, also called the envelope sender or return path, and the name the server gives in HELO or EHLO. It does not check the From address you see in your mail app. Linking the visible From to SPF is the job of DMARC, covered in its own lesson.

A domain publishes exactly one TXT record starting with v=spf1. RFC 7208 says a domain must not have multiple SPF records, and if a receiver finds more than one, the result is permerror, a permanent error.

Mechanisms and qualifiers

The record is a list of terms read from left to right. Each mechanism tests the sending IP address; the first one that matches decides the result. The common mechanisms are:

• ip4 and ip6: an address or range, such as ip4:192.0.2.0/24.
• a and mx: the addresses of the domain's A/AAAA or MX hosts.
• include: run another domain's SPF record and match if it passes. Email services publish one for their customers.
• all: matches everything, so it goes last and sets the default.
• ptr and exists: rarely needed; RFC 7208 marks ptr as do not use.

The 10-lookup limit

Some terms need a DNS query when they are evaluated. RFC 7208 lists them: the include, a, mx, ptr and exists mechanisms and the redirect modifier. An SPF check must stop after 10 of these, counting everything inside included records too, and return permerror. The ip4, ip6 and all mechanisms cost nothing.

There is a second limit for lookups that find nothing. RFC 7208 calls a query that returns no answers or NXDOMAIN a void lookup, and recommends that receivers return permerror after more than two of them. An include pointing at a domain that no longer has SPF counts as one.

Fixing a record that is over the limit

Count first, because nested includes are invisible in your own record. Then reduce:

• Remove services you no longer send through: an include for an old newsletter tool still costs lookups.
• Replace a and mx with ip4 or ip6 ranges when your own servers' addresses are stable.
• Send bulk or marketing mail from a subdomain such as news.example.com with its own SPF record, so the two lists don't add up.

Why SPF alone is not enough

SPF breaks when mail is forwarded. The forwarding server's address isn't in the original domain's record, and RFC 7208 notes that forwarders would have to rewrite the MAIL FROM into their own domain to avoid it. It also says nothing about the From header people read.

That is why large mailbox providers ask for more than SPF. Google's guidelines require SPF or DKIM from all senders and SPF, DKIM and DMARC from bulk senders, and recommend that SPF include all of a domain's senders. Yahoo requires bulk senders to implement both SPF and DKIM and publish a DMARC policy.