How SPF Protects Your Email Reputation
Sender Policy Framework (SPF) is an email validation standard defined in RFC 7208. It allows domain owners to publish a public DNS TXT record declaring which mail servers, IP addresses, and third-party delivery providers are authorised to send emails on behalf of their domain.
The 10-DNS-Lookup Limit Explained
To protect mail servers against denial-of-service amplification attacks, the SPF specification strictly limits the number of recursive DNS lookups to a maximum of 10. Mechanisms like include:, a, mx, ptr, and redirect= count toward this limit.
If your SPF record triggers more than 10 DNS queries, receiving servers (including Google Workspace and Microsoft 365) return an SPF PermError, causing legitimate emails to fail authentication and land in spam.
SPF Qualifiers: ~all vs -all
- ~all (SoftFail): Advises receiving servers to accept non-matching emails but tag them as potentially unverified. Recommended during initial setup and testing.
- -all (HardFail): Instructs receiving servers to strictly reject any email originating from an unlisted server. Recommended when DMARC enforcement is active.
- ?all (Neutral) / +all (Pass All): Permits any server in the world to send on your behalf. These qualifiers leave your domain completely open to spoofing and should never be used in production.