ZeroSpams

SPF setup and configuration

SPF is a single line of text in your domain’s DNS, and it’s easy to get wrong. One mistake, like a second record or one service too many, and SPF fails for every email you send.

Updated · 2 min read · By the ZeroSpams team

The short answer

SPF (Sender Policy Framework) is a DNS record listing the servers allowed to send email for your domain. Receivers check it on every message. A domain may have only one SPF record, and checking it may take at most 10 DNS lookups; break either rule and SPF fails completely [1]. We build one correct record covering every service you use.

What’s included

  • A check of every service that sends as your domain, so none is missed and none is listed twice.
  • One SPF record, merged from any duplicates.
  • Staying within 10 DNS lookups, by removing unused services and using the leanest include for each provider.
  • The right ending for your situation: ~all while testing, -all when everything is covered.
  • SPF for subdomains that send email (for example a marketing subdomain), and a "sends nothing" record for domains that never send.
  • Testing from each sender after the change.

How we do it

  1. Read your current SPF record and count its DNS lookups.
  2. List every sender, from mailboxes and website to invoicing and marketing tools.
  3. Build the new record, and check it against the limits before publishing.
  4. Publish it, replacing any old records.
  5. Test from each sender and confirm SPF passes.

Why SPF breaks so often

Every time a business adds a new tool that sends email (a CRM, a booking system, a newsletter service), its setup guide says "add our include to your SPF record". Some people add a second SPF record instead of editing the first; two records means SPF fails for every message [1]. Others keep adding includes until the record needs more than 10 DNS lookups, at which point SPF also fails [1]. Neither problem shows an error on your side: your emails just start going to spam.

SPF alone isn’t enough

SPF checks the hidden "envelope" sender, not the address your customers see, and it breaks when email is forwarded. That’s why SPF needs DKIM and DMARC alongside it. See email authentication setup for all three together.

Common questions

What does ~all versus -all mean?

~all (soft fail) asks receivers to treat unlisted senders with suspicion; -all (fail) says they are not allowed. We use ~all while confirming every sender is covered, then -all if it suits your setup, with DMARC doing most of the enforcement.

Can I have two SPF records if I use two providers?

No. A domain may publish only one SPF record; with two, SPF fails for all your email [1]. Both providers go in the same record.

What happens if I exceed 10 lookups?

SPF returns an error and is treated as failed [1]. We reduce the lookups by removing unused services and choosing leaner entries.

Sources

Numbers in this guide come from these studies and publications. Links open the original.

  1. RFC 7208: Sender Policy Framework (SPF)IETF, 2014