SPF
SPF is a TXT record listing which servers may send mail for a domain. A receiving server looks up the record for the return path domain and checks whether the machine that connected is on the list. It breaks when a message is forwarded, because the forwarding server is not on your list, and that is why SPF on its own is not enough.
At a glance
- Category
- Domain authentication
- Lives in
- A TXT record at the return path domain
- Checks
- The connecting server against the record's list
- Lookup limit
- Ten DNS lookups — exceeding it is a permanent error
- Breaks on
- Forwarding, because the forwarder is not on your list
- Specified in
- RFC 7208
How it works
The record names the mechanisms that authorise a sender: addresses, ranges, and includes that pull in another domain's record. A receiving server takes the envelope sender's domain, fetches the record, and evaluates the mechanisms in order against the connecting address until one matches. The final qualifier decides what happens when nothing does. Evaluation is capped at ten DNS lookups; a record that needs more is a permanent error, and a permanent error is a fail, not a pass.
Why it matters
SPF is the cheapest authentication to publish and the easiest to get subtly wrong. It authorises servers rather than messages, so it says nothing once a message is forwarded, and it is checked against the envelope sender rather than the address a reader sees, which is why it needs alignment to mean anything under DMARC. It is still worth having, because it is one of the two paths DMARC can pass on and the one that covers mail signed by nobody.
Example
A domain publishes a TXT record for its return path subdomain naming one include for its sending service and ending with a tilde-all qualifier. A receiving server checks the connecting address against that include, finds a match and records a pass. Months later a second service is added by appending another include, and the team counts the lookups first, because two includes that each pull in three more would exceed the limit and fail everything.
Common mistakes
- 01Publishing two SPF records on the same name, which is a permanent error rather than the union of the two.
- 02Adding includes until the record exceeds ten DNS lookups, at which point every check fails rather than merely the new sender.
- 03Ending the record with a plain minus-all before every legitimate sender has been found, which blocks your own mail.
- 04Relying on SPF alone and being surprised when forwarded mail fails, since the forwarding server was never on your list.
In Rasket
The SPF record for your return path is part of the record set we generate, and verification keeps watching it. Domains
Related terms
Frequently asked questions
Should my record end in ~all or -all?
Start with ~all, which asks receivers to treat unlisted senders as suspicious rather than refusing them. Move to -all once DMARC reports confirm every legitimate sender is accounted for.
Why does SPF fail when my mail is forwarded?
Because the check is against the server that connected, and after a forward that is the forwarding host rather than yours. A DKIM signature survives the same journey, which is why both are needed.
What is the ten lookup limit?
SPF evaluation may perform at most ten DNS lookups, counting each include and similar mechanism. Going over produces a permanent error, which receivers treat as a failure rather than ignoring.
Sources
Last updated 16 September 2026.
Start sending this morning
Verify a domain and send your first email in minutes.