How SPF is evaluated
The receiving server takes the envelope sender domain, fetches v=spf1, and tests the connecting IP against ip4, ip6, a, mx, and include mechanisms. Nested includes count toward a hard limit of ten DNS lookups. Exceed it and legitimate mail can fail SPF even when the IP is “supposed” to be allowed.
A record worth keeping
- Exactly one SPF record on the apex (and on any subdomain that sends mail).
- An include for every ESP you actually use — and none for ones you abandoned.
- A terminal
-allonce you are confident, or~allwhile you watch reports. - Never
+all.
Generate a draft with the SPF generator, then read SPF explained before you tighten the policy. Pair SPF with DMARC or spoofed From headers still get through.