The 8 fields and concepts you'll meet in the response — defined in plain English, each with a real example value.
Sender Policy Framework—a DNS TXT record specifying which servers can send email for a domain.
SPF helps prevent email spoofing by letting domain owners declare authorized senders. Receiving servers check if the sending IP matches the SPF record. SPF is one component of email authentication alongside DKIM and DMARC.
Examplev=spf1 include:_spf.google.com -all
An SPF directive that matches email senders, like ip4:, include:, mx:, or a:.
Mechanisms define who can send. ip4:/ip6: match IP addresses. include: references another SPF record. mx: matches the domain's mail servers. a: matches the domain's A record. Each mechanism can have a qualifier prefix (+, -, ~, ?).
Exampleinclude:_spf.google.com, ip4:192.0.2.0/24, mx
A prefix on SPF mechanisms indicating how to handle matches: + (pass), - (fail), ~ (softfail), ? (neutral).
+ means pass (this is the default if no qualifier). - means hard fail (reject). ~ means soft fail (suspicious but accept). ? means neutral (no opinion). The final "all" mechanism determines behavior for unmatched senders.
Example-all (reject), ~all (softfail), +ip4:... (allow)
SPF mechanism that references another domain's SPF record.
Include recursively checks another domain's SPF. This is how you authorize third-party services—include their SPF domain. Each include counts toward the 10 lookup limit. Nested includes (the included record also has includes) can quickly exhaust the limit.
Exampleinclude:_spf.google.com, include:spf.protection.outlook.com
SPF result when sender isn't authorized but should be accepted with suspicion (~all).
Soft fail (~all) marks email as suspicious without rejecting it. Receivers may filter to spam or add warnings. Soft fail is useful during SPF rollout when you're not certain all senders are listed. Progress to hard fail (-all) once confident.
Examplev=spf1 include:... ~all
SPF result when sender isn't authorized and should be rejected (-all).
Hard fail (-all) instructs receivers to reject unauthorized email. This provides the strongest protection against spoofing but requires confidence that all legitimate senders are listed. Misconfiguration can cause legitimate email to be rejected.
Examplev=spf1 include:... -all
The maximum of 10 DNS lookups allowed during SPF validation.
Each include:, a:, mx:, and exists: mechanism requires a DNS lookup. ip4: and ip6: don't count. Exceeding 10 lookups causes permerror (permanent error), failing SPF validation. Complex configurations with many includes can hit this limit.
Example3 includes + 2 mx + 1 a = 6 lookups (within limit)
A permanent SPF error caused by configuration problems like too many lookups or syntax errors.
Permerror means SPF couldn't be evaluated due to a problem with the record itself. Common causes: exceeding 10 DNS lookups, syntax errors, multiple SPF records. Unlike temperror (temporary DNS issues), permerror requires fixing the SPF record.
ExamplePermerror: too many DNS lookups (exceeds 10)
