MailVitalsEmail deliverability
Sign inEarly access
Module 2 · Lesson 5 of 37

SPF: Sender Policy Framework

Part of The Complete Email Deliverability Course — Email Authentication Protocols.

SPF authenticates the envelope sender by checking if the sending IP is authorized in DNS.

Every SPF record must begin with v=spf1.

Mechanisms and DNS lookup impact:

Mechanism Counts toward 10-lookup limit?
ip4 / ip6 ❌ No
a ✅ Yes
mx ✅ Yes
include ✅ Yes
exists ✅ Yes
redirect ✅ Yes
all ❌ No

The 10 DNS lookup limit is the most common SPF misconfiguration. Exceeding it returns PermError, which DMARC treats as a fail.

Common SPF mistakes:

  • ❌ Multiple SPF records on one domain (causes PermError)
  • ❌ Using +all or ?all (authorizes everyone)
  • ❌ Stale include statements for old services
  • ❌ Not ending with -all or ~all

Sign in to keep track of what you have read.

Beat · paid monitoring

A heartbeat for your email.

Beat runs every check on this site on a schedule — 41 checks, 34 blacklists, real inbox placement — and the moment something breaks it tells you what broke, why it matters, and the exact fix.

Get early access to BeatSee what Beat watches
example.comWatching
  • SPFpass
  • DKIMpass
  • DMARCp=none
  • Blacklists0 of 34

Illustrative. Your domain, every few hours.

Also from us:Pulse — your own sending infrastructureConsulting — $65/hr, no retainer