This guide assumes SPF records is already deployed and passing. It covers what breaks at scale and how mature teams operate it.
Edge cases that break a working setup#
- Exceeding the 10-lookup limit, which causes a permerror and effectively disables SPF.
- Publishing two SPF records on one domain; receivers treat this as a permanent failure.
- Forgetting that SPF checks the Return-Path (envelope sender), not the visible From address, so forwarded mail often fails.
- Using +all or leaving ?all in production, which authorizes everyone.
- Mail forwarded through mailing lists or personal forwarders, which alters headers and content.
- Acquisitions and rebrands that introduce domains nobody audited.
- Vendors silently changing their sending infrastructure.
Operating it as infrastructure#
- Assign an owner for each sending domain and each vendor relationship.
- Put DNS records under version control or a change-review process.
- Alert on authentication pass rate drops and reputation changes, not just outages.
- Run a quarterly audit against the setup steps below.
- Document runbooks for the three most common failures.
Reference: the baseline setup#
- Inventory every service that sends mail as your domain: your ESP, CRM, helpdesk, billing system, and internal mail server.
- Collect each vendor's SPF include mechanism (for example include:_spf.google.com) from their documentation.
- Publish one TXT record at the root of the domain starting with v=spf1, listing each include, then ending with ~all (softfail) while testing.
- Verify with a lookup tool that the record resolves and stays under 10 DNS lookups and 255 characters per string.
- Move to -all once DMARC reports confirm all legitimate sources pass.
example.com. IN TXT "v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.10 -all"Frequently asked questions#
Does SPF alone stop spoofing?
No. SPF validates the envelope sender, which spoofers can set to their own domain while forging the visible From. DMARC closes that gap by requiring alignment.
What does ~all versus -all mean?
~all is softfail: receivers mark but usually accept. -all is hardfail: receivers may reject. Start with ~all, graduate to -all once DMARC data is clean.
How do I fix 'too many DNS lookups'?
Remove unused includes, replace includes with ip4/ip6 mechanisms where vendors publish static ranges, or use an SPF flattening service.