The most common SPF mistakes are publishing more than one SPF record, exceeding 10 DNS lookups, ending with +all, using ptr, and forgetting domains that send no mail. Each one either breaks evaluation or weakens it. Walk this list against every domain you own.
The checklist
1. Two SPF records on one name. The RFC says multiple SPF records are not permitted for the same owner name. If a check finds more than one, the result is permerror. When you add a vendor, merge their include into the existing record instead of adding a second TXT record.
2. More than 10 lookups. Includes, a, mx, ptr, exists and redirect all count, and nested includes count too. The result of going over is permerror. See the lookup limit post for how to trim.
3. A broken record that nobody notices. A record with a syntax error also returns permerror. Run a validator after every edit.
4. Using ptr. The RFC heading for this mechanism literally reads "do not use". It is slow, adds DNS load and is the reason the standard says it SHOULD NOT be published.
5. Ending with +all or no all at all. +all authorizes everyone. A record with no all leaves an implicit neutral outcome for unlisted senders. End with ~all or -all.
6. Text after all. Mechanisms listed after all are never tested and MUST be ignored. A vendor include pasted after -all does nothing.
7. No record on domains that never send. Parked and unused domains are attractive to spoofers. The RFC gives the answer: for a domain that sends no mail, publish v=spf1 -all.
8. Assuming SPF protects the visible From address. SPF checks the envelope sender (the MAIL FROM) and the HELO name, not the From header users see. That gap is why DMARC alignment exists.
A clean example
example.com. IN TXT "v=spf1 ip4:203.0.113.10 include:_spf.mailvendor.example -all"
One record, one include, a literal IP that costs no lookup, and a firm ending. The domain and addresses here are placeholders from documentation ranges.
How to audit in ten minutes
- Query the TXT records for each sending domain and count how many start with
v=spf1. - Expand every include and total the lookups.
- Confirm the record ends with the qualifier you chose on purpose.
- List all domains you own and confirm the non-sending ones carry the null record.
If you do not have a complete list of domains, that is the first problem to solve. An asset inventory that includes domains and subdomains is a reasonable place to start.
Quick check
Can I have one SPF record per subdomain?
Yes. The rule is one record per owner name, so example.com and mail.example.com can each have their own, and each gets a separate lookup budget.
Sources
Last reviewed: 19 October 2026.
