Browse the Learning Center
SPF
Records, include chains, the 10-lookup limit, PermError fixes.
37 guides
Read in order
Get to p=reject
The full route from an unprotected domain to an enforced policy, in the order the work actually happens.
5 steps
The three records
SPF, DKIM and DMARC explained in the order they make sense. Start here if the acronyms are new.
3 steps
Add a sending platform
Authorise a new ESP without breaking the authentication you already have.
3 steps
All SPF guides
IONOS SPF setupIONOS SPF setup starts with your sending inventory, authoritative DNS access, and a safe validation plan before any TXT-record change in production.
Kitterman SPF checker: interpret and retest an SPF lookupKitterman SPF checker results explained: inspect the public SPF record, repair evidenced DNS issues, check lookup limits, and retest safely.
Proofpoint SPF checker: check and validate an SPF recordProofpoint SPF checker workflow: check a published SPF record, interpret SPF outcomes, repair DNS evidence, and validate a delivered message.
SPF check failure: how to interpret and fix the resultSPF check failure: interpret Palisade SPF record results, repair duplicate or over-limit records, and retest the published DNS record after DNS changes.
SPF record format: version, mechanisms, and qualifiersSPF record format starts with v=spf1 in one DNS TXT record. Learn how mechanisms, qualifiers, modifiers, and the final all term are evaluated.
What is SPF? Sender Policy Framework explainedWhat is SPF? Sender Policy Framework is a DNS record that authorizes mail servers for a domain's envelope sender or HELO identity for a domain.
PowerDMARC SPF checkerPowerDMARC SPF checker information: what PowerDMARC publicly lists, what an SPF lookup can establish, and which evidence is still needed today.
How many SPF records can a domain have and why do multiple records cause PermError?Multiple SPF records at one DNS name cause PermError. Learn why receivers do not merge them, how to combine legitimate senders, and how to retest.
How do I fix the 'SPF PermError: too many DNS lookups' error?SPF PermError: too many DNS lookups means SPF exceeded its 10-term DNS limit. Map the lookup chain, remove or separate senders, then retest.
Mailchimp SPF record: when do you need one?Mailchimp DMARC alignment can pass through aligned DKIM without Mailchimp in SPF. Inspect headers, verify DNS, and validate the sending path.
Why does Gmail report an SPF error?Gmail SPF errors mean Gmail could not authorize the sending IP for the envelope domain it evaluated. Inspect headers, repair the SPF path, and retest now.
DNS TXT SPF record: what it is and how it worksAn SPF policy is published in DNS as a TXT record starting with v=spf1. Learn the record format, size limits, and how to check if your domain has one.
EasyDMARC SPF checker: what it shows and how to read the resultEasyDMARC SPF checker folds SPF into a combined domain score. See what Low, Medium, and High mean and how to verify SPF yourself against RFC 7208.
Email authentication for Gmail: SPF, DKIM, and DMARC requirementsEmail authentication for Gmail requires SPF or DKIM for every sender, and SPF, DKIM, and DMARC together once volume reaches 5,000 messages a day.
How to validate SPF record syntaxValidate SPF syntax by checking the DNS TXT record's v=spf1 version tag, mechanism grammar, and the 10 DNS-lookup limit defined in RFC 7208.
How do I set up DMARC, SPF, and DKIM on DreamHost?How to set up DMARC, SPF, and DKIM on DreamHost: add the required DNS records, validate the live sending path, and review DMARC reports safely.
SPF flattening toolSPF flattening tool guidance: check DNS lookup usage, understand the 10-lookup limit, assess flattening risk, and retest public SPF records.
Does a subdomain need its own SPF record?Does a subdomain need its own SPF record? Yes, when it is the MAIL FROM or HELO domain SPF evaluates. Learn how to verify the exact identity.
What causes SPF TempError?SPF TempError means SPF evaluation hit a temporary DNS or processing failure. Find the evaluated domain, trace its lookups, and validate the sending path.
What does 'all' mean in an SPF record?What does 'all' mean in an SPF record? Learn how SPF all matches senders, what qualifiers mean, and how to validate the final policy correctly.
Why do phishing emails pass SPF and DKIM checks?Why do phishing emails pass SPF and DKIM checks? They authenticate a sending domain, not whether a message, brand claim, or sender identity is honest.
How to configure SPF and DKIM for ChargebeeConfigure SPF and DKIM for Chargebee by authenticating the custom SMTP provider, connecting it in Chargebee, and validating a real notification.
How do I set up SPF and DKIM for SendGrid?SendGrid SPF and DKIM setup: authenticate a domain, publish account-generated DNS records, verify SendGrid, inspect headers, and validate DMARC.
How do I set up SPF and DKIM for Amazon SES?Set up SPF and DKIM for Amazon SES by publishing identity-specific Easy DKIM records, configuring custom MAIL FROM, and validating real mail.
HubSpot SPF and DKIM setup: connect and verifyHubSpot SPF and DKIM setup: connect your sending domain, publish account-generated DNS records, verify HubSpot, and validate a real message.
Why Brevo does not provide SPF alignment by defaultBrevo SPF alignment is not default because standard domain setup uses Brevo's return path. Verify aligned DKIM, headers, and DMARC results now.
How to set up SPF and DKIM for Brevo (formerly Sendinblue)How to set up SPF and DKIM for Brevo: authenticate the sending domain, publish Brevo's account-generated DNS records, then validate a real message.
How do I set up SPF and DKIM for Customer.io?Customer.io SPF and DKIM setup: add a sending domain, publish its account-generated DNS records, verify delivery, and check DMARC alignment.
How do I set up SPF and DKIM for Klaviyo?How to set up SPF and DKIM for Klaviyo: configure a branded sending domain, publish Klaviyo's DNS records, verify it, and validate DMARC alignment.
How do I set up SPF and DKIM for Mailchimp?Mailchimp SPF and DKIM setup: authenticate a sending domain with Entri or two CNAME records, preserve SPF, add DMARC, and validate a campaign.
How do I set up SPF and DKIM for Zoho Campaigns?Set up SPF and DKIM for Zoho Campaigns by verifying the sender, publishing Zoho's DNS values, testing a delivered campaign, and checking DMARC.
How do I set up SPF for Google Workspace?How to set up SPF for Google Workspace: publish Google's SPF TXT record, merge other senders safely, and validate DNS and delivered mail safely.
SPF and Constant Contact: what to configureConstant Contact does not require its servers in SPF. Self-authenticate with DKIM and DMARC, then verify a campaign from your custom domain.
SPF hard fail vs softfailSPF hard fail uses -all and softfail uses ~all. Compare the authorization statements, receiver handling, and safe selection criteria.
Mailgun SPF and DKIM Setup: Exact DNS RecordsSet up Mailgun SPF and DKIM with the exact DNS records. Learn when to use DKIM CNAMEs, why send-only domains skip Mailgun MX, and how to verify alignment.
How do I set up SPF and DKIM for Postmark?Postmark authenticates via its own Return-Path, so the include is unnecessary. Real setup: one DKIM TXT record plus a Return-Path CNAME for alignment.
DKIM vs SPF: The Difference and Why It MattersSPF checks whether the sending server is authorized; DKIM signs the message so tampering shows. Here is how they differ and why you need both.