SPF misconfigurations can cause email delivery failures or leave your domain vulnerable to spoofing. Understanding common mistakes helps you avoid them.
Multiple SPF Records
A domain must have exactly one SPF record. Multiple TXT records starting with "v=spf1" cause validation failures (permerror). When using multiple email services, combine them into a single record using multiple include: mechanisms.
Exceeding DNS Lookup Limit
Nested includes add up quickly. If your record includes Google Workspace (2 lookups), Microsoft 365 (2 lookups), and your own servers, you're already using 4-5 lookups. Each third-party service may have their own nested includes. Monitor your lookup count and flatten when needed.
Using +all
Never use "+all"—it allows anyone to send as your domain, defeating the purpose of SPF. This is equivalent to having no SPF at all and leaves you vulnerable to spoofing. Always use "-all" or "~all".
Forgetting Third-Party Senders
Marketing tools (Mailchimp, Sendgrid), helpdesk software (Zendesk), and CRM systems often send email on your behalf. If they're not in your SPF record, their emails may be rejected. Audit all services that send as your domain.