SPF
Sender Policy Framework (RFC 7208)
Definition:SPF is an email authentication standard that allows domain owners to publish a public DNS TXT record specifying which mail servers and IP addresses are authorized to send email on behalf of their domain.
Never create multiple SPF records in your DNS. If you use both Google Workspace and an email tracking tool, combine them into one line: `v=spf1 include:_spf.google.com include:sendgrid.net ~all`. Having two separate SPF TXT records breaks authentication globally.
yourdomain.com. IN TXT "v=spf1 include:_spf.google.com ~all"Frequently Asked Questions about SPF
Detailed Technical Breakdown
When a receiving mail server receives a message, it inspects the sender's envelope Return-Path domain, queries DNS for that domain's SPF record, and checks whether the transmitting IP address is listed in the authorized mechanisms (e.g. `ip4:`, `include:`, `a`, `mx`).
The SPF specification (RFC 7208) enforces a strict **10 DNS lookup limit**—if your SPF record requires more than 10 nested DNS queries, receiving servers throw a `PermError` and fail authentication.
A domain must have **exactly one SPF TXT record**; publishing multiple SPF records on a single domain invalidates all of them, causing immediate deliverability failure.
Why it matters for Cold Email & Deliverability
SPF authentication is mandatory for delivering email to Google Workspace, Microsoft 365, and Yahoo inboxes.
Proper SPF records prevent malicious attackers from spoofing your domain name in fraudulent email campaigns.
How to optimize SPF
- Publish an SPF TXT record on your sending domain (e.g., `v=spf1 include:_spf.google.com ~all`).
- Ensure your SPF record does not exceed the strict 10 DNS lookup limit using an SPF flattening tool if necessary.
- Ensure you have ONLY ONE SPF record published per domain name.
- Use the soft-fail (`~all`) or hard-fail (`-all`) qualifier as recommended by your email provider.
Common SPF Mistakes
- Creating two separate SPF TXT records on the same domain instead of combining them into a single record.
- Exceeding the 10 DNS lookup limit by including multiple third-party SaaS tools (`include:sendgrid.net include:hubspot.com include:_spf.google.com...`).
- Using the neutral `?all` qualifier, which provides zero authentication protection.
Send 2,000 Cold Emails / Mo For $0
Why pay $97/mo for Instantly or Smartlead? Get 3 rotated inboxes, warmup, and 2,000 sends completely free.