Why SPF exists
Before SPF, anyone could put any address in the From: header of a message and most receivers would accept it. That made domain spoofing trivial and phishing cheap.
SPF (RFC 7208) makes spoofing more expensive: receivers can ask DNS whether the sending IP is authorised by the claimed domain and downgrade or reject mail that fails. Modern receivers also feed the SPF result into a combined DMARC verdict — without SPF, your DMARC posture is half-built.
What an SPF record looks like
A single TXT record at the apex, starting with v=spf1. The body is a sequence of mechanisms (include, a, mx, ip4, ip6, exists) followed by an all qualifier that says what to do with mail that did not match any earlier mechanism.
yourdomain.com. TXT "v=spf1 include:_spf.sndr.sh include:_spf.google.com ~all"The `all` qualifier — the most important byte
-all (hard fail): receivers must reject mail that did not match. Strongest signal — and the right answer once you trust your include set.
~all (soft fail): receivers may quarantine, often used during ramp-up. Better than nothing, weaker than -all.
?all (neutral) and +all (pass everything): effectively unauthenticated. Never publish +all — it authorises every sender on the internet to spoof you.
The 10-lookup limit
RFC 7208 caps the total DNS lookups required to evaluate your SPF record at 10. Each include, a, mx, exists, ptr, and redirect counts. Exceeding the limit produces a PermError and most receivers treat that as a failure.
Teams routinely blow past the limit by stacking includes for every SaaS that sends mail on their behalf. The fix is SPF flattening — periodically resolving each include to its underlying IPs and publishing those directly. SNDR's /tools/spf-checker counts your lookups against the cap.
How SNDR handles SPF
When you verify a sending domain in SNDR, we generate the exact include: directive you need to add. Multiple include statements are fine — you can run SNDR alongside Google Workspace, Microsoft 365, Marketing Cloud, etc. in the same SPF record.
We publish ~all in our recommended snippet by default for new domains; once your DMARC reports show clean alignment for a week or two, tighten to -all. The /tools/spf-checker page validates the published record and warns when the lookup count approaches the spec's 10-lookup ceiling.