An SPF record can be perfectly valid text and still fail for every email. The usual cause is the 10 DNS lookup limit. When a receiving server has to make more than 10 lookups to evaluate the record, SPF returns permerror — and to many receivers that is the same as having no SPF at all.
What counts toward the limit
The SPF standard, RFC 7208 section 4.6.4, says these terms each cause DNS lookups and count toward the limit of 10:
| Counts | Does not count |
|---|---|
include: |
ip4: |
a |
ip6: |
mx |
all |
ptr |
exp= |
exists: |
|
redirect= |
Lookups inside every include: count too. One include: for a large email provider can use three or four lookups by itself.
There is a second, smaller limit: void lookups. A term that returns no answer or “name does not exist” is a void lookup, and the RFC says receivers should allow only two. An include: for a service the client stopped using years ago is a common source.
Why MSP clients hit it
Each new tool adds an include: — Microsoft 365, a marketing platform, a helpdesk, an invoicing system, a website form plugin. Nobody removes the old ones. After a few years the record quietly goes over 10.
How to fix it
- List every service that really sends as the domain. Check with the client. Most records carry at least one service nobody uses any more.
- Remove what is not used. This is the safest and most common fix.
- Drop
ptr. The RFC says it should not be used, and it costs lookups. - Replace
aandmxwithip4:/ip6:where the addresses are stable and you control them. - Move bulk senders to a subdomain, such as
news.example.com, with its own SPF record. Each subdomain gets its own budget of 10. - Be careful with “flattening”. Replacing includes with copied IP addresses works until the provider changes its addresses — then mail fails without warning. If you flatten, something has to keep it updated.
Check before you change it
After every change, check the record again and send a test email to a mailbox you control. Look for spf=pass in the message headers.
Watchvera checks SPF on every client domain on each scan, flags missing and soft (
~all) records, and records every change to the SPF record in the domain’s history.
See how Watchvera handles this: DMARC, SPF and DKIM monitoring.