Should I use ~all or -all in my SPF record?

It's usually recommended to use ~all due to forwarding and mailing lists breaking SPF. This gives more flexibility while still marking the email as softfail.

How can I check my SPF lookup limit?

You can use the Domain Check Tool. https://dmarcdefender.io/tools/domain-check

How do I reduce my SPF lookups?

Ideally you can remove unused mechanisms. If not, consider splitting up your email sending domains. You can also use dmarcdefender.io's SPF flattening.

SPF Explained

Last updated by Stuart Larsen on August 13, 2026

Sender Policy Framework is an email security protocol that allows domain owners to specify a list of IP addresses that are authorized to send email on that domain's behalf.

Policy

SPF is published as a DNS TXT record on the domain.

v=spf1 ip4:1.2.3.0/24 include:_spf.google.com ~all

Example SPF record allowing emails to be sent from Google Workspace and the IP range 1.2.3.0/24.

Policies are evaluated from left to right, until a matching term is found.

ip4:1.2.3.0/24: Matches if the IP address in the CIDR range 1.2.3.0/24
include:_spf.google.com: Matches if the IP address matches the policy at _spf.google.com
~all: A fallback mechanism that matches all IP addresses. The "~" qualifier specifies softfail

Since most domain owners don't directly manage email servers, most policies are usually a string of vendor include statements.

Mechanisms

There are a number of different mechanisms that can be used, but the most common are:

Mechanism	Description	Example
ip4	Matches an IPv4 address or CIDR range.	`ip4:192.0.2.0/24`
ip6	Matches an IPv6 address or CIDR range.	`ip6:2001:db8::/32`
include	Matches when another domain's SPF policy passes for the IP address.	`include:_spf.google.com`
all	Matches every sender and sets the default policy.	`~all`

Qualifier

By default, each mechanism (ip4/include/etc) has a qualifier of + (pass). The other qualifiers are:

+ pass
- fail
~ softfail
? neutral (rarely used)

It's generally recommended to use ~ softfail on your ~all mechanism over - fail. Legitimate email can sometimes fail SPF due to mailing lists, email forwarding, and dynamic IP addresses. Using ~ gives your mailbox provider some flexibility in handling these cases. Ideally DKIM is also setup correctly and will help ensure legitimate email is delivered.

Alignment

SPF evaluates the domain found in the envelope sender / Return-Path. This is not the visible From address domain. During the DMARC alignment check, the alignment of the Return-Path domain and From address domain is validated. Because of this, you can technically pass SPF, but still fail DMARC.

Lookup Limits

To prevent Denial of Service (DoS) and unreasonable load on the DNS servers, SPF evaluation is restricted to 10 lookups. Terms that require a lookup include include, a, mx, ptr, exists and redirect. You can validate that you're below the 10 lookup limit using the Domain Check tool.

There is also a limit of two void lookups. Void lookups occur when DNS returns NXDOMAIN, or a successful response with no relevant records.