BoxsetHub

How to Set Up SPF Records Correctly (And Avoid the 10-Lookup Limit)

A step-by-step guide to creating, validating, and maintaining SPF records. Learn how the 10 DNS lookup limit works and how to stay under it.

Boxset TeamFeb 19, 20268 min read
SPFDNSauthenticationemail security

What SPF Actually Does

SPF (Sender Policy Framework) is a DNS TXT record that lists every server authorized to send email on behalf of your domain. When Gmail receives an email from [email protected], it checks your domain's SPF record to see if the sending server is on the approved list.

If the server isn't listed, SPF fails — and that's one strike against your email reaching the inbox.

10 Lookups

Maximum DNS lookups allowed in a single SPF record before it breaks

Building Your SPF Record

An SPF record is a single TXT record published on your domain's DNS. Here's the anatomy:

v=spf1 include:_spf.google.com include:amazonses.com ip4:203.0.113.0/24 -all
  • v=spf1 — Required. Declares this is an SPF record.
  • include: — Authorizes another domain's SPF record (costs 1 lookup each).
  • ip4: / ip6: — Authorizes a specific IP or range (costs 0 lookups).
  • -all — Fail anything not explicitly listed. Use ~all (softfail) during initial setup.

The 10-Lookup Limit Explained

This is where most teams run into trouble. SPF allows a maximum of 10 DNS lookups. Each mechanism that requires a DNS query counts:

The danger is nested includes. When you add include:_spf.google.com, Google's SPF record itself contains more includes — each one counts against your limit of 10.

Step-by-Step Setup

Common Mistakes

  1. Multiple SPF records — You can only have ONE SPF TXT record per domain. Two records cause both to fail.
  2. Exceeding 10 lookups — SPF returns a permanent error (PermError) and is treated as a fail.
  3. Using +all — This authorizes the entire internet to send as you. Never use it.
  4. Forgetting subdomains — mail.yourdomain.com needs its own SPF record; it doesn't inherit from the root domain.

When to Use ~all vs -all

  • ~all (softfail) — Use during initial setup or when you're not 100% sure you've listed all senders. Emails from unlisted servers are marked suspicious but not rejected.
  • -all (hardfail) — Use once you've confirmed all sending sources. Emails from unlisted servers are rejected. This is the recommended final state.

Pro Tip from Boxset Team

Start with ~all, monitor for a week using DMARC reports to catch any legitimate senders you missed, then switch to -all.

Frequently Asked Questions

Verify Your Email Authentication

Check your SPF, DKIM, DMARC, and BIMI records in seconds. Boxset's DNS Health Check identifies misconfigurations before they impact your deliverability.

Run Free DNS Check