SPF records: what they do, and the ten-lookup limit that breaks them
The Sender Policy Framework (SPF) is a protocol that lets a domain owner authorize which hosts can send email using its domain name by publishing a policy in DNS. Receiving mail servers check this record to verify the sender's IP address, helping to reject unauthorized mail and reduce spoofing. SPF is a foundational component of DMARC, which uses SPF's authentication result to verify alignment with the visible "From" header and apply policy.
What an SPF record does
The Sender Policy Framework (SPF) is a protocol that lets a domain owner authorize which hosts can send email using its domain name. It does this by publishing a policy in the DNS. An SPF record is a DNS record that declares which hosts are, and are not, authorized to use a domain name for the "HELO" and "MAIL FROM" identities. These identities are part of the SMTP envelope, separate from the visible "From:" header in an email.
When a receiving mail server gets a message claiming to be from your domain, it can perform an SPF check. It looks up the SPF record for your domain and checks if the connecting server's IP address is listed among the authorized senders. A "pass" result is an explicit statement that the client is authorized to inject mail with the given identity. This allows receivers to reject mail from unauthorized sources, reducing spam and phishing attempts that forge sender addresses.
How to set one up
You create an SPF record by publishing a DNS TXT record for your domain. The record must start with v=spf1. Mechanisms follow, separated by spaces, to specify authorized senders. Common mechanisms are:
* a or mx to authorize your domain's own A or MX records.
* ip4: or ip6: to authorize specific IP addresses or ranges.
* include: to authorize another domain's designated senders (e.g., include:_spf.google.com for Google's mail servers).
* all at the end to specify a default result for all other IPs. A hyphen (-) denotes a hard "fail," while a tilde (~) denotes a "softfail," a weaker statement.
The critical ten-lookup limit
During an SPF check, the evaluating receiver must perform DNS queries to resolve mechanisms like mx, a, and include. SPF results must be computed within a limit of 10 DNS lookups. This limit includes all lookups triggered recursively by include: statements. Each include: can itself contain several other mechanisms that consume multiple lookups.
If a check exceeds this limit, the result is a "permerror." This signals an error condition that definitely requires DNS operator intervention to be resolved. To receivers, this is as good as not having a valid SPF policy, leaving you unprotected against spoofing.
SPF within DMARC
SPF is a foundational component of DMARC (Domain-based Message Authentication, Reporting, and Conformance). DMARC uses SPF (and DKIM) to authenticate the sender's domain. DMARC authenticates use of the RFC5322.From domain by requiring that it match (be aligned with) an Authenticated Identifier. For SPF, this means the domain in the RFC5322.From header (what users see) must align with the domain used in the SMTP MAIL FROM command (which SPF checks). DMARC is a policy framework that uses the results of SPF and DKIM authentication to instruct receiving servers on how to handle emails that fail DMARC's alignment checks and to request feedback reports RFC 7489.
Frequently asked questions
What's the difference between SPF and DMARC?
SPF is a specific authentication protocol for authorizing sending servers. DMARC is a policy framework that uses the results of SPF and DKIM authentication to instruct receiving servers on how to handle emails that fail DMARC's alignment checks and to request feedback reports RFC 7489. DMARC relies on SPF and/or DKIM to achieve a "pass" result.
Why did my SPF check return "permerror"?
A "permerror" often results from exceeding the 10 DNS lookup limit. This requires you to simplify your record by removing unnecessary include: mechanisms, as using redirect is more suitable for consolidating both authorizations and policy within a single administrative domain. Other syntax errors, like incorrect mechanism formatting, can also cause a permanent error.
Should I use -all or ~all in my record?
A hyphen (-) denotes a hard "fail," instructing receivers to reject mail from unauthorized sources. A tilde (~) denotes a "softfail," a weaker statement often used during initial deployment to monitor results without causing strict rejection.
Can I have multiple SPF records for one domain?
No. Multiple records will cause a "permerror."
Does SPF protect the "From" address I see in my email client?
Not directly. SPF authenticates the domain used in the SMTP "MAIL FROM" command (the envelope sender), which is separate from the visible "From:" header. DMARC uses SPF to help protect the visible "From" address by requiring alignment between these domains.
Where to start
Sources
---
_Researched with AI assistance from a live passive security scan run by NEL (scan eph_mt8aq8ai_10fu), which was not retained; citing 2 external sources; 18 factual claims were extracted and checked against their sources (10 of 18 verified); each verification step was independently recorded and signed by Vitna, which attests that the check ran and what its verdict was — not that the underlying claim is true (records 8b443167-7fc7-4ee0-a19e-60a5d6ffcdae, e4de4945-8b0d-4aa8-ad77-c38209d5d9ae, 9ce3170e-92a7-468f-b3c0-8237e0225b3e, +108 more, verify at https://vitna.costrinity.xyz/api/evidence/verify); reviewed and approved by admin:nelnationale before publishing; published by NEL Professionals with no individual byline._
Get up to 100 scans or unlimited lifetime access starting at $15.
View Plans →Comments (0)
No comments yet. Be the first to comment!