What is the 10 DNS lookup limit in SPF (RFC 7208)?

RFC 7208 Section 4.6.4 limits SPF evaluation to a maximum of 10 DNS-querying mechanisms (include, a, mx, ptr, exists, redirect). Exceeding 10 lookups causes a PermError and causes Gmail, Outlook and Yahoo to reject or spam-folder your emails.

Should I use ~all (SoftFail) or -all (HardFail) in my SPF record?

Use ~all (SoftFail) while testing or when pairing with DMARC (p=quarantine or p=reject), as recommended by Google and M3AAWG. Use -all (HardFail) once all legitimate sending IPs and ESPs are confirmed.

Can a domain have multiple SPF TXT records?

No. A domain must publish exactly one v=spf1 TXT record. Publishing two or more v=spf1 records causes an immediate SPF PermError. Combine all sending services into a single v=spf1 record using this generator.

RFC 7208 COMPLIANT · LIVE 10-LOOKUP COUNTER · 100% FREE

Free SPF Record Generator & Lookup Calculator

Build a syntax-verified v=spf1 DNS TXT record for Google Workspace, Microsoft 365, Amazon SES, SendGrid, Mailgun and custom IPs while tracking your RFC 7208 10-DNS-lookup budget in real time.

1. Select Email Providers (`include:`)

2. Server Mechanisms & Policy

Allow domain mx servers (+1 lookup) Allow domain a record (+1 lookup)

Additional IPv4 / IPv6 Addresses (comma-separated, 0 DNS lookups):

Custom include: domains (comma-separated):

Enforcement Policy (All Mechanism):

Generated DNS TXT Record (Host: @)

DNS Lookups: 4 / 10 (Safe)

v=spf1 mx include:_spf.google.com ~all

🔍 Inspect Existing Domain SPF Record in Live DNS:

Free SPF Record Generator & Lookup Calculator

1. Select Email Providers (`include:`)

2. Server Mechanisms & Policy

Complete Your Email Authentication Stack