Help Center

Setup & Records

Smart SPF: fix the SPF 10-lookup limit

SPF has a hard rule: a receiver will only follow 10 DNS lookups when checking your record. Go over that and SPF fails for every email you send, and nobody warns you. Smart SPF collapses all your senders into one record that never exceeds the limit.

Where to find it
Setup & Records → Smart SPF
Time needed
10 minutes
You will need
The list of services that send email for you (Microsoft 365, your CRM, marketing tool, etc.)

Why this happens

Every include: in your SPF record costs at least one lookup, and most vendors' includes contain more includes of their own. Microsoft 365 alone uses several. Add a CRM, a helpdesk, a newsletter tool and a payroll system, and a typical company is over the limit without realising. The symptom is mail landing in spam or being rejected with no obvious cause.

Set it up

  1. Pick the domain

    Open Smart SPF and choose the domain.

  2. Add your senders

    Use the one-click buttons for common providers (Google Workspace, Microsoft 365, Salesforce, SendGrid, Mailchimp), or type any other include: value from your vendor's documentation.

  3. Choose how strict to be

    Soft Fail (~all) marks unlisted senders as suspicious without blocking them. Hard Fail (-all) tells receivers to reject them. Soft fail is the safe default while you are still discovering senders; you can switch later.

  4. Analyze & Preview

    DMARCS follows every include down to the actual IP addresses and shows you the lookup count the flattened record collapses to. If it's still over 10 (rare, but possible with a very long list), it's flagged clearly so you can trim.

  5. Create the hosted record

    Click Create Hosted Record. You get a single include: line to put in your SPF record in place of everything else.

Don't delete your old SPF entries straight away. Add the new hosted include first, wait for a day of reports to confirm SPF is passing for every sender, then remove the old entries. That way there is never a moment when a legitimate sender is unlisted.

Keep it from creeping back

New tools get added to SPF records all the time, often by someone who doesn't know about the limit. Set up an SPF Lookup Limit alert so DMARCS emails you when a record gets close to 10, instead of waiting for mail to start bouncing. To see your whole SPF chain drawn as a tree, use the SPF Surveyor.

Still need a hand?

Email support@dmarcs.com, call +971 4 240 4441, or open a ticket from Support inside the app.

Contact Support