What is the 10 DNS lookup limit in SPF?

RFC 7208 limits SPF evaluations to a maximum of 10 DNS queries to prevent Denial of Service amplification. Exceeding this limit causes an SPF PermError.

What is the difference between ~all and -all in SPF?

~all represents SoftFail (messages from unauthorized servers are accepted but marked as suspicious). -all represents HardFail (unauthorized messages should be rejected immediately).

How do I validate my SPF record?

Query TXT records using our online DNS Lookup tool to verify your SPF syntax and authorized senders.

Home/DNS Lookup/SPF Record

SRV DMARC

DNS Resource Record Type

SPF Record: Sender Policy Framework Record

TXT-based email authentication policy listing authorized sending mail server IP addresses and relay hosts.

Record Type

SPF

Query Protocol

DNS Port 53

Standard / RFC

RFC 7208

Recommended TTL

3600 seconds

Query Live SPF Records

Query any domain name to inspect authoritative SPF records, response latency, and TTL values.

Loading DNS lookup tool...

BIND Zone File Syntax

Standard BIND representation of this record in authoritative master zone files:

example.com. 3600 IN TXT "v=spf1 include:_spf.google.com ~all"

Recommended TTL: 3600 seconds (1 hour).

Common Configuration Pitfalls

Exceeding the strict RFC 7208 limit of 10 DNS lookup mechanisms (include, a, mx, ptr, exists), resulting in 'SPF PermError'.
Creating more than one SPF TXT record on the same domain.
Using the deprecated type-99 SPF record instead of standard TXT.

How the SPF Record Operates in DNS Resolution

Sender Policy Framework (SPF) is implemented as a DNS TXT record starting with 'v=spf1'. It lists the authorized IP addresses, CIDR subnets, and third-party relay hosts (such as Google Workspace, SendGrid, or Mailchimp) permitted to dispatch outbound emails from your domain name.