Tick where your mail is sent from and get one correct SPF record, with the number of DNS lookups it costs.
Sender Policy Framework (RFC 7208) is a TXT record that lists the servers allowed to send mail for a domain. A receiving server looks it up, compares it with the address the message arrived from, and treats mail from anywhere else the way the end of the record tells it to.
A record is read left to right. ip4 and ip6 name
addresses or ranges. mx allows the servers that receive the
domain's mail and a allows the address the domain name points to.
include pulls in the record of a provider that sends for you.
The record ends with all: -all says reject everything
else, ~all says accept it but mark it, and ?all says
nothing.
Two records. A domain may publish one SPF record. A second one, often added when a new mail service is set up, makes both invalid. Add the new sender to the record you already have.
More than ten lookups. Each include,
a and mx costs a DNS lookup, and so does every
include nested inside a provider's record. Past ten, receivers return a
permanent error and SPF fails for all of your mail. This generator counts the
lookups your record causes directly. The
SPF checker counts the nested ones once the
record is published.
A sender left out. Billing systems, newsletter tools, help
desks and scanners send as your domain too. List them all before moving to
-all, or their mail will be refused.
Add the record as a TXT record at the domain itself, which most DNS panels write as @. Then run the SPF checker to confirm it is the only one and stays under the limit. SPF checks the envelope sender and not the From address a person sees, so it does not stop spoofing alone. Sign your mail with DKIM and publish a policy with the DMARC record generator.
The provider includes offered here are the ones each provider documents for its customers. Providers change them now and then, so confirm against the setup page in your own account.
In the DNS zone of the domain, as a TXT record on the domain itself. Most DNS panels show that host as @ or leave the name box empty. A subdomain that sends mail, such as mail.example.com, needs its own record.
Start with ~all while you confirm that every system sending for you is listed. Once DMARC reports show all of your real mail passing, move to -all. A domain that sends no mail should publish v=spf1 -all straight away.
No. RFC 7208 says a domain must not have more than one, and receivers return a permanent error when they find two. Put every sender into a single record.
Evaluating a record may cause at most ten DNS lookups, counting include, a, mx, exists and redirect, and counting those inside included records. ip4 and ip6 cost nothing. Going over the limit fails SPF for every message.
No. It only writes the record for you to copy. Nothing is published until you add it at your DNS provider.