SPF: one record, ten lookups, and no second chances
Every service that sends on your behalf wants you to add an SPF include. Two of the rules make that quietly dangerous.
Rule one: exactly one SPF record
A domain may publish only one. Two is not additive, it is a permanent error, and receiving systems treat the result as unusable rather than picking one.
This happens constantly, because each provider tells you to add a record, and adding a record is exactly what you do. Correct is merging their include into the record you already have:
v=spf1 include:provider-one.example include:provider-two.example -allBefore adding anything, check what is already published at the apex.
Rule two: ten DNS lookups
Evaluating an SPF record is capped at ten DNS lookups. Every include, a, mx, ptr and exists counts, and includes are recursive: a provider's include can itself contain several more.
Exceed it and evaluation fails permanently. Nothing warns you, and the failure appears gradually as receivers evaluate it.
Three or four providers is enough to get close, because you do not control what is inside their includes and they expand them without telling you. Check the total with an SPF validator rather than counting the entries you can see.
If you are near the limit
- Remove includes for services you no longer use, which is usually where the slack is
- Move a sender onto a subdomain with its own SPF record, which gets its own budget
- Replace an include with the specific mechanisms it resolves to, accepting that you now own keeping it current
Do not rely on SPF alone
SPF breaks on forwarding, because the forwarding server is not an authorised sender. DKIM survives forwarding, so a domain with both is far more robust than one with SPF alone. If you are publishing a DMARC policy of quarantine or reject, you want DKIM working, or forwarded mail will be caught by your own policy.
Check after anything touches DNS
Registrar automation, tenant migrations and provider setup wizards all rewrite records helpfully. Re-check SPF after any of them, because a merged record can be replaced by a fresh one that drops everything you had.
Need help with any of this?
These notes are free and always will be. If you would rather someone just set it up, or you are stuck on something similar, get in touch at hello@opsira.io.