Authentication & DNS

SPF (Sender Policy Framework)

Q: Which SPF mechanisms count toward the RFC 7208 10-DNS-lookup limit?

The mechanisms `include`, `a`, `mx`, `ptr`, and `exists` (plus the `redirect` modifier)—along with any nested lookups inside included third-party records—count toward the hard limit of 10 DNS queries. The `ip4`, `ip6`, and `all` mechanisms require 0 DNS lookups.

Q: What happens if I publish two separate `v=spf1` TXT records on the same domain?

RFC 7208 Section 3.2 strictly forbids multiple SPF records on a single hostname. If a domain publishes two `v=spf1` TXT records, receiving mail servers immediately return `spf=permerror` and fail SPF for all emails.

Q: Should I end my SPF record with `~all` (SoftFail) or `-all` (HardFail)?

Both `~all` and `-all` are valid in production when paired with an enforced DMARC policy (`p=quarantine` or `p=reject`). Many enterprise engineers prefer `~all` during DMARC transitions so forwarded emails can rely on DKIM alignment without early envelope rejection, then lock down `-all` on dedicated sending subdomains.

What is SPF (Sender Policy Framework)?

An RFC 7208 email authentication protocol where a domain owner publishes a DNS TXT record listing all IP addresses and third-party mail servers (`ip4:`, `ip6:`, `include:`) authorized to send mail using that domain in the RFC 5321 `MAIL FROM` (Return-Path) address.

Why SPF (Sender Policy Framework) Matters in Production

Receiving mail servers query your SPF record on every incoming connection. If your SPF record is missing, omits an active sending service, or exceeds the strict RFC 7208 limit of **10 nested DNS lookups** (`PermError`), your emails fail SPF authentication and face spam filtering or rejection.

Engineering & Sender Best Practices

• Publish exactly one `v=spf1` TXT record per domain or subdomain—multiple SPF records cause an automatic `PermError`.
• Keep total DNS-querying mechanisms (`include`, `a`, `mx`, `ptr`, `exists`, `redirect`) at or below 10 lookups.
• Move third-party ESPs onto dedicated sending subdomains (e.g., `mail.yourdomain.com`) to isolate SPF lookup budgets.
• End production SPF records with `~all` (SoftFail) or `-all` (HardFail), never `+all` or `?all`.

Real-World Production Scenario

Fixing an SPF 14-Lookup PermError via Subdomain Delegation

A B2B company had accumulated 6 `include:` statements on their root domain (`_spf.google.com`, `sendgrid.net`, `spf.protection.outlook.com`, `servers.mcsv.net`, `mail.zendesk.com`, `hubspot.com`), totaling 14 nested DNS lookups—4 over the RFC 7208 limit of 10. Receiving MTAs returned `spf=permerror`. By moving marketing (`news.company.com`) and transactional mail (`notify.company.com`) to subdomains, root SPF lookups dropped to 4.

Production Outcome: Reduced root domain SPF lookups from 14 to 4 and restored 100% SPF pass rates.

Technical Implementation & Wire Example

Production SPF DNS TXT Record (<10 Lookups)

; Authorized senders: Google Workspace + Postmark + dedicated IPv4
yourdomain.com.  3600  IN  TXT  "v=spf1 ip4:198.51.100.24 include:_spf.google.com include:spf.mtasv.net -all"

You can test and validate your domain's SPF lookup count for free using the MailVeri SPF Generator & Validator tool.

DNS Email Authentication & Routing Protocol Reference

Gmail, Yahoo & Microsoft 365 Bulk Sender Standards

Protocol	DNS Host & Type	RFC Spec	Operational Requirement & Failure Impact
MX	@ (IN MX)	RFC 5321 / 7505	Routes inbound mail by priority; missing or Null MX (`0 .`) causes 100% hard bounce
SPF	@ / Return-Path (IN TXT)	RFC 7208	Authorizes sending IPs/ESPs; must stay strictly ≤10 DNS lookups to avoid PermError
DKIM	selector._domainkey (TXT/CNAME)	RFC 6376	2048-bit cryptographic header signature; survives email forwarding intact
DMARC	_dmarc (IN TXT)	RFC 7489	Enforces From-domain alignment (`p=none`, `p=quarantine`, `p=reject`) + RUA reports
ARC / BIMI	default._bimi (IN TXT)	RFC 8617	Preserves auth across forwarders (ARC) and displays verified brand logos (BIMI)

Primary Engineering & Deliverability Playbook

DNS TXT & SPF Records for Email Senders: The 10-Lookup Rule Explained →

How to structure SPF records, avoid the 10-DNS-lookup PermError trap, and authenticate multiple ESPs cleanly.

Read Primary Guide •Pay-As-You-Go Verification ($9/10K, $59/100K, $299/1M)

Related 2026 Technical Deep Dives & Benchmarks

Auth Stack

SPF, DKIM & DMARC Explained: Complete DNS Email Authentication Setup Guide →

Subdomains

Transactional vs Marketing Emails: Subdomain Isolation & IP Pools →

Free Authentication & DNS Tools & Workflows

SPF Record Generator

Build & validate ≤10 DNS lookups

DMARC Policy Generator

Configure p=quarantine / p=reject

DNS MX Record Lookup

Inspect mail exchange priorities

Connected Workflows:Amazon SES →Instantly →Smartlead →Deliverability Checklist →

Frequently Asked Questions About SPF (Sender Policy Framework)

Which SPF mechanisms count toward the RFC 7208 10-DNS-lookup limit?

The mechanisms `include`, `a`, `mx`, `ptr`, and `exists` (plus the `redirect` modifier)—along with any nested lookups inside included third-party records—count toward the hard limit of 10 DNS queries. The `ip4`, `ip6`, and `all` mechanisms require 0 DNS lookups.

What happens if I publish two separate `v=spf1` TXT records on the same domain?

RFC 7208 Section 3.2 strictly forbids multiple SPF records on a single hostname. If a domain publishes two `v=spf1` TXT records, receiving mail servers immediately return `spf=permerror` and fail SPF for all emails.

Should I end my SPF record with `~all` (SoftFail) or `-all` (HardFail)?