SPF (Sender Policy Framework) allows you to declare which servers are authorized to send emails for your domain. When SPF fails, recipients see "SPF: FAIL" in headers and may reject or spam your legitimate emails. Common causes: unlisted sending server, incorrect syntax, exceeding 10 DNS lookups limit, or missing record. A well-configured SPF is essential for deliverability.
Symptoms of SPF Failure
- Your emails arrive in spam at recipients
- Headers show "spf=fail" or "spf=softfail"
- Some recipients reject your emails with SPF message
- DMARC reports show SPF failures
Causes of SPF Failures
- Unauthorized IP: The sending server isn't listed in SPF. Add its IP or include.
- Lookup limit: SPF allows max 10 DNS lookups. Too many includes or redirects = PermError.
- Incorrect syntax: A syntax error makes the entire SPF invalid. Use a validator.
Diagnosis and Correction
- Check your current SPF: dig TXT example.com | grep spf
- Validate syntax with mxtoolbox.com/spf.aspx or similar tool.
- Count lookups: each include, a, mx, redirect counts. Maximum 10.
- Identify all your sending services and ensure they're included.
SPF Monitoring with MoniTao
MoniTao monitors your SPF validity:
- Alert if your SPF record changes or disappears
- Verification of syntax and lookup count
- Detection of sending IPs not covered by SPF
Optimized SPF
- Always end with -all (hard fail) rather than ~all (soft fail) in production
- Use IP mechanisms directly when possible to save lookups
- Flatten includes with tools like dmarcian to stay under 10 lookups
- Update SPF each time you add a new sending service
FAQ - SPF Fail
What's the difference between -all and ~all?
-all = hard fail, reject. ~all = soft fail, accept but mark. Use -all once your SPF is validated.
How to add Gmail/O365 to SPF?
Gmail: include:_spf.google.com. O365: include:spf.protection.outlook.com. Check their official docs.
What if I have more than 10 lookups?
Flatten includes to direct IPs, or use a service like dmarcian to manage it.
Is SPF enough for deliverability?
No. Also configure DKIM and DMARC. All three together form complete protection.
Ready to Sleep Soundly?
Start free, no credit card required.