SPF, short for Sender Policy Framework, is a DNS record that lists the servers and services allowed to send email for your domain. Receiving mail servers check it to decide whether a message really came from an approved source.
How SPF Works
An SPF record is a TXT record that starts with v=spf1, followed by the approved senders, such as your email provider, your newsletter service and your web server, and ends with a rule for everything else. A record ending in -all tells servers to reject unlisted senders, while ~all asks them to treat unlisted senders as suspicious. When a message arrives, the receiving server checks the sending server’s address against your list.
The 10-Lookup Limit
Each include in an SPF record, such as one for an email provider, may contain more includes of its own. SPF allows at most 10 of these DNS lookups in total. Go over the limit and the whole record fails, which can send legitimate mail to spam. Domains that use many sending services hit this limit often, and it is one of the most common SPF problems.
Common SPF Mistakes
The most frequent mistakes are having two SPF records instead of one, which makes both invalid, forgetting to add a new sending service, and using +all, which lets anyone send as you. A domain should have exactly one SPF record, updated whenever you add or remove a service that sends email for you.
The Domibot SPF Checker lists every service in your record, counts your lookups against the limit of 10 and flags anything that would cause mail to fail.