Email & DNS guide
What your SPF record actually does
Learn how authorized senders, includes and the DNS lookup limit affect your email configuration.
Start with the right sender identity
SPF checks whether an IP address is authorized for the envelope sender domain, often shown as Return-Path. That domain can differ from the visible From address. A provider can pass SPF for its own domain while still needing alignment or DKIM to satisfy your domain's DMARC policy.
Build one complete policy
List every service that sends legitimate mail using this envelope domain. Your DNS zone should contain one SPF policy beginning with v=spf1. Add or remove a provider's mechanisms within that policy; publishing another SPF policy at the same name causes an error. Other unrelated TXT records can remain.
Understand includes and limits
An include asks SPF to evaluate another policy. Includes can contain further includes, and the evaluation has a limit of ten DNS-lookup mechanisms and modifiers. Counting only the visible include terms is insufficient. Avoid manual flattening unless you have a reliable way to track the provider's changing addresses.
Interpret the final mechanism
The all mechanism matches senders not matched earlier. -all signals failure and ~all signals soft failure. Neither repairs missing authorized senders. After an edit, query public DNS and send test messages through each service; inspect the recipient's Authentication-Results rather than relying only on a DNS checker.
Primary references
Provider dashboards and instructions can change. Confirm current values with your provider before editing DNS.