Check your domain against the SPF record lookup limit

At most 10 DNS lookups

Receivers count the terms that need a DNS lookup, across the record and every record it includes. include, a, mx, ptr, exists and redirect count. all, ip4, ip6 and exp do not. Past 10, the check returns permerror and SPF fails. Google also says a record can have up to 10 include tags.

Counts

include, a, mx, ptr, exists, redirect

Does not count

all, ip4, ip6, exp

At most 2 void lookups

A void lookup is a lookup that finds nothing, either an empty answer or a name that does not exist. Receivers should stop after two of them, with permerror. A stale include for a service you left is the usual cause.

An mx term may name at most 10 mail hosts

Checking one mx term must not look up more than 10 address records, so a domain with more than 10 MX hosts breaks an mx term that points at it.

One SPF record per domain

A domain may publish only one SPF record, the TXT record that starts with v=spf1. With two or more, receivers stop with permerror and SPF fails for every message. Merge every sender into one record.

What the sign before each term means

Each mechanism can start with a qualifier. With none, it is +. The qualifier of the first mechanism that matches the sending server is the result.

+ (or no sign)

pass. The server may send for the domain.

-

fail. The server may not send for the domain.

~

softfail. The server is probably not allowed.

?

neutral. The domain says nothing either way.

The all at the end

all matches every server, so it sets what happens to servers the record did not list. -all fails them and ~all soft fails them. +all (or a bare all) lets any server on the internet pass, and ?all says nothing. Terms after all are never checked. A record with no all and no redirect ends as neutral.

include and redirect

include checks another domain's SPF record and matches when that record passes. If the included domain has no SPF record, the whole check ends in permerror. redirect hands the check to another domain's record, and is ignored when the record has an all anywhere.

Where the DMARC record lives

The DMARC record is a TXT record at _dmarc under the domain, for example _dmarc.example.com. It starts with v=DMARC1. If that name has no record, receivers look at each parent name in turn, one label at a time. Two or more DMARC records at one name are all discarded. RFC 9989 replaced RFC 7489 as the DMARC standard in May 2026.

What p=none means

p=none states no preference about mail that fails DMARC. It still turns on the reports when rua is set. Gmail accepts p=none from senders of more than 5,000 messages a day to Gmail accounts, who must publish a DMARC record.

DMARC tags

v Version

Must be DMARC1 and must be the first tag. Otherwise receivers ignore the whole record.

p Policy

What the domain asks receivers to do with mail that fails DMARC. Without it, receivers treat the record as p=none. none: No preference is stated. quarantine: Failing mail is suspicious. reject: Failing mail is not valid use of the domain.

sp Subdomain policy

The policy for subdomains that exist. When it is missing, p applies to subdomains too. Default: same as p.

np Non-existent subdomain policy

The policy for subdomains that do not exist in DNS. When it is missing, sp applies, or p when sp is missing too. Default: same as sp, or p.

t Test mode

Says whether the domain is testing its policy. It does not change the reports. Default: n. y: Testing. Receivers apply one level below the stated policy. n: Apply the policy as stated.

psd Public suffix flag

Says whether the domain is a public suffix, a name under which others register their domains. Default: u. y: The domain is a public suffix. n: Not a public suffix. The domain is the organizational domain for itself and its subdomains. u: Not a public suffix. The lookup up the DNS tree decides the organizational domain.

rua Aggregate reports

Where receivers send summary reports, as a comma-separated list of addresses. Receivers only have to support mailto addresses. Without it, receivers send no aggregate reports. Default: no reports.

ruf Failure reports

Where receivers send a report about each failing message, as a comma-separated list of addresses. Without it, receivers send no failure reports. Default: no reports.

adkim DKIM alignment

How closely the DKIM signing domain must match the From domain. Default: r. r: Relaxed. The same organizational domain is enough. s: Strict. The exact same name.

aspf SPF alignment

How closely the SPF domain (the envelope sender) must match the From domain. Default: r. r: Relaxed. The same organizational domain is enough. s: Strict. The exact same name.

fo Failure report options

When to send a failure report. Ignored without ruf. Default: 0. 0: When every check fails to give an aligned pass. 1: When any check gives something other than an aligned pass. d: When a DKIM signature fails. s: When SPF fails.

pct Percentage (retired)

Retired by RFC 9989 and marked historic. Under RFC 7489 it was the share of failing mail the policy applied to. t=y is meant to work like pct=0, and t=n like pct=100.

rf Failure report format (retired)

Retired by RFC 9989 and marked historic.

ri Report interval (retired)

Retired by RFC 9989 and marked historic.

MX preference

Each MX record has a preference number. Senders try the lowest number first.

No MX record

With no MX record, senders deliver to the domain's own address record, as if it were an MX with preference 0.

Null MX

A single MX record with preference 0 and the host . says the domain accepts no email. Mail to it fails at once.