What Is an SPF Record?
What an SPF record is, how to read one, the mechanisms like -all and ~all, and the 10-DNS-lookup limit that silently breaks SPF.
By the ToolsHub team · Updated May 1, 2026
An SPF record is a single DNS TXT record listing which servers may send email as your domain. A receiver checks the sending server against the list; if it's not there, the message is treated according to your policy. Validate any domain's record with our SPF Checker.
Reading a record
A record like v=spf1 include:_spf.google.com ip4:198.51.100.0/24 -all means: use SPF version 1; authorise Google's servers and that IP range; and -all — reject everything else. The final mechanism is the important one:
-all(Fail) — reject unlisted senders. Strongest, and the goal.~all(SoftFail) — accept but mark. Sensible while testing.?all(Neutral) — no protection.+all— authorises the whole internet. Never use it.
The 10-lookup limit
Every include:, a, mx and similar mechanism costs one DNS lookup, and nested includes count too. SPF allows a maximum of ten — go over and it returns a permanent error most receivers treat as a failure. Adding one more provider can break authentication for all your mail. Direct ip4: and ip6: entries cost nothing, so replacing includes with IP ranges is the usual fix. Our SPF Record Generator counts lookups live as you build.