What SPF does
SPF (Sender Policy Framework) is a single DNS TXT record beginning v=spf1 that names the IP addresses and include: statements authorized to send email for your domain. Receiving servers check the sending host against this list.
The one-record rule
A domain must have exactly one SPF record. Two or more is an RFC violation and many receivers fail the check outright. Nattvakt flags multiple SPF records as a failure — merge them into a single record.
The ten-lookup limit and -all
SPF evaluation may perform at most 10 DNS lookups; too many include: statements break it with a permerror. Flatten or consolidate includes to stay under the limit.
End your record with -all (hard fail) or ~all (soft fail) rather than +all, which authorizes the entire internet to send as you.
Frequently asked questions
What does an SPF record look like?
A TXT record such as v=spf1 include:_spf.google.com ~all, listing authorized senders and ending with an all mechanism.
Can I have two SPF records?
No. Exactly one v=spf1 record is allowed; multiple records cause SPF to fail. Merge them into one record.
What is the 10 DNS lookup limit?
SPF evaluation may perform at most 10 DNS lookups. Exceeding it causes a permerror and authentication failure. Reduce includes or use SPF flattening.
What is the difference between -all and ~all?
-all is a hard fail that tells receivers to reject unlisted senders; ~all is a soft fail that accepts but marks them. -all is stricter.