SPF Record Syntax for Transactional Email
Write, merge, and troubleshoot SPF records for transactional email domains without exceeding DNS lookup limits.
TL;DR
Publish exactly one SPF TXT record per domain. Keep all authorized senders in that one record, stay under the 10 DNS-lookup limit, and remember that DMARC checks SPF alignment against the visible From domain.
What you will learn
- Understand SPF mechanisms and qualifiers
- Merge multiple sender includes safely
- Diagnose SPF failures that break DMARC alignment
SPF record shape
An SPF record is a DNS TXT record that starts with v=spf1 and ends with a result such as -all or ~all.
Example:
example.com. TXT "v=spf1 include:_spf.postscale.io include:_spf.google.com -all"
This says that Postscale and Google are authorized senders for the domain, and other senders should fail.
Common mechanisms
| Mechanism | What it means | Counts toward DNS lookup limit? |
|---|---|---|
ip4: | Authorize an IPv4 range | No |
ip6: | Authorize an IPv6 range | No |
include: | Authorize another domain's SPF policy | Yes |
a | Authorize A/AAAA records | Yes |
mx | Authorize MX hosts | Yes |
exists: | Authorize based on DNS existence | Yes |
redirect= | Delegate the whole policy | Yes |
all | Match everything else | No |
The DNS lookup limit is 10 for mechanisms that require DNS. Too many SaaS includes can break SPF even if every individual include is correct.
Qualifiers
| Qualifier | Result | Common use |
|---|---|---|
+ | Pass | Usually omitted |
- | Fail | Production enforcement |
~ | Softfail | Transition period |
? | Neutral | Rarely useful |
For production transactional mail, -all is cleaner once every legitimate sender is included. Use ~all while discovering old senders.
Return-Path matters
SPF authenticates the envelope sender, also called Return-Path or bounce domain. If your visible From domain is example.com but bounces use ps-bounces.example.net, SPF can pass while DMARC fails because the domains do not align.
For DMARC alignment, either:
- Use a Return-Path under the visible From domain.
- Rely on aligned DKIM for DMARC pass.
- Configure a custom bounce domain with your provider.
Merge records safely
If DNS already has:
"v=spf1 include:_spf.google.com ~all"
and Postscale gives you:
"v=spf1 include:_spf.postscale.io -all"
merge them into one record:
"v=spf1 include:_spf.google.com include:_spf.postscale.io ~all"
Do not publish both records.
Debug sequence
- Confirm there is exactly one TXT record starting with
v=spf1. - Count DNS-lookup mechanisms.
- Check that included domains resolve.
- Confirm the SMTP Return-Path domain.
- Inspect
Authentication-Resultsheaders. - Confirm DMARC alignment, not just SPF pass.
Use the SPF checker for quick parsing and lookup-count checks.
References
Frequently asked questions
- Can a domain have two SPF records?
- No. A domain should publish one SPF TXT record. Multiple records cause SPF permerror at receivers.
- Does SPF passing always make DMARC pass?
- No. SPF must pass and align with the visible From domain for DMARC to use it.
Related guides
Put the guide into production
Postscale brings sending, inbound processing, DMARC reporting, and masked addresses behind one API so the operational pieces stay connected.