Question 1

What is an SPF record?

Accepted Answer

SPF (Sender Policy Framework) is a DNS TXT record that lists the mail servers authorised to send email on behalf of your domain. When a receiving server gets an email from your domain, it checks your SPF record to verify the sending server is authorised. This prevents email spoofing and improves deliverability.

Question 2

What does SPF syntax look like?

Accepted Answer

An SPF record starts with v=spf1, followed by mechanisms like ip4: (authorised IP), include: (delegate to another domain's SPF), a (your domain's A record), mx (your domain's MX records), and ends with ~all (softfail) or -all (hardfail). Example: v=spf1 include:_spf.google.com ip4:203.0.113.0/24 -all

Question 3

What is the SPF 10 DNS lookup limit?

Accepted Answer

SPF limits you to 10 DNS lookups during evaluation. Each include:, a, mx, ptr, and exists mechanism counts as one lookup. Exceeding 10 causes a "permerror" which can result in SPF failure. Use SPF record flattening to stay within the limit.

Question 4

What is the difference between ~all and -all?

Accepted Answer

~all (softfail) means mail from unlisted servers should be accepted but marked as suspicious — most receivers will deliver but may flag it. -all (hardfail) means mail from unlisted servers should be rejected outright. Use -all for maximum protection if you're confident all legitimate mail servers are listed.

Question 5

Does SPF prevent phishing?

Accepted Answer

SPF alone is not sufficient — it only checks the envelope sender (Return-Path), not the From header visible to users. Combined with DKIM and DMARC, it provides strong protection. DMARC uses SPF and DKIM alignment to protect the visible From header.

SPF Record Checker

Frequently Asked Questions