What does the SPF 10-lookup limit mean?

SPF allows at most 10 DNS lookups when evaluating a record; exceeding it causes a permerror and can fail authentication. Our SPF checker counts your lookups so you stay under the limit.

What's the difference between ~all and -all?

~all is a soft fail (mark suspicious but usually accept), while -all is a hard fail (reject unauthorised senders). Use -all once every legitimate source is listed.

Can I have more than one SPF record?

No. A domain must have exactly one SPF record; multiple records cause a permerror. Combine all your senders into a single record instead.

Email · 4 min read

What Is an SPF Record?

What an SPF record is, how to read one, the mechanisms like -all and ~all, and the 10-DNS-lookup limit that silently breaks SPF.

By the ToolsHub team · Updated May 1, 2026

An SPF record is a single DNS TXT record listing which servers may send email as your domain. A receiver checks the sending server against the list; if it's not there, the message is treated according to your policy. Validate any domain's record with our SPF Checker.

Reading a record

A record like v=spf1 include:_spf.google.com ip4:198.51.100.0/24 -all means: use SPF version 1; authorise Google's servers and that IP range; and -all — reject everything else. The final mechanism is the important one:

-all (Fail) — reject unlisted senders. Strongest, and the goal.
~all (SoftFail) — accept but mark. Sensible while testing.
?all (Neutral) — no protection.
+all — authorises the whole internet. Never use it.

The 10-lookup limit

Every include:, a, mx and similar mechanism costs one DNS lookup, and nested includes count too. SPF allows a maximum of ten — go over and it returns a permanent error most receivers treat as a failure. Adding one more provider can break authentication for all your mail. Direct ip4: and ip6: entries cost nothing, so replacing includes with IP ranges is the usual fix. Our SPF Record Generator counts lookups live as you build.

Avoiding the 10-lookup trap

The most common SPF failure is exceeding the limit of ten DNS lookups. Every include: (for a provider like Google or a marketing tool) can trigger further lookups of its own, and they add up quickly across several services.

Audit your include: entries and remove any service you no longer use.
Prefer ip4: / ip6: for fixed servers, which cost no lookup.
Keep to a single SPF record — a second one causes a permerror.

Our SPF Checker counts the lookups for you and flags problems, and the SPF Record Generator builds a valid record from provider presets.

Frequently asked questions

What is an SPF record?: An SPF record is a TXT DNS entry listing the servers allowed to send email for your domain. Receivers check it to confirm a message came from an authorised source.
What does the SPF 10-lookup limit mean?: SPF allows at most 10 DNS lookups when evaluating a record; exceeding it causes a permerror and can fail authentication. Our SPF checker counts your lookups so you stay under the limit.
What's the difference between ~all and -all?: ~all is a soft fail (mark suspicious but usually accept), while -all is a hard fail (reject unauthorised senders). Use -all once every legitimate source is listed.
Can I have more than one SPF record?: No. A domain must have exactly one SPF record; multiple records cause a permerror. Combine all your senders into a single record instead.

Try the tool

SPF Checker →SPF Record Generator →