Expert Tools
What is SPF?
Sender Policy Framework (SPF) is a DNS TXT record that lists which mail servers are allowed to send e-mail on behalf of a domain. When another mail server receives a message, it can check the sending server against this list - if it isn't listed, that's a sign the message might be spoofed.
SPF only checks the technical sending server, not the visible "From" address a person sees, and it stops working the moment a message gets forwarded through another server. That's part of why it's normally deployed alongside DKIM and DMARC rather than on its own.
The 10-lookup limit
RFC 7208 caps SPF evaluation at 10 DNS lookups. Every include:, a, mx, ptr, exists:, and redirect= counts - including ones nested inside an include. Go over 10, and mail servers are required to treat the whole record as broken, even if every individual mechanism in it is correct. This check counts that for you, following every include recursively.
A note on timing
This check itself never caches anything - every run is a fresh lookup. But a DNS resolver still respects the record's own TTL, so a change you just published may not show up here (or anywhere else) until that TTL has passed. Many providers default a TXT record's TTL to 3600 seconds (one hour); if you're actively tweaking an SPF record, it's worth temporarily lowering its TTL to something like 120 seconds while you work on it, then raising it again once you're happy with the result.
Especially if this domain doesn't send mail yet
A domain with no MX records and no mailboxes can feel like SPF doesn't apply yet - that's backwards. Without SPF, nothing tells a receiving server that no mail should ever come from this domain, which makes an unused domain an easy one to spoof mail from. Publishing v=spf1 -all before a single mailbox exists closes that off permanently, at no cost, with nothing left to remember later.