Question 1

What is an SPF record?

Accepted Answer

SPF (Sender Policy Framework) is a DNS TXT record that lists the servers authorized to send email on behalf of your domain. Receiving servers check the connecting IP against this list to detect forgery.

Question 2

What does the 10 DNS lookup limit mean?

Accepted Answer

SPF evaluation is limited to 10 DNS lookups (include, a, mx, exists, redirect count). Exceeding this limit causes a permerror and SPF fails. Use ip4/ip6 mechanisms (which don't count) to stay under the limit.

Question 3

What qualifier should I use at the end?

Accepted Answer

-all (hard fail) rejects messages from unlisted servers. ~all (soft fail) marks them but still delivers. Use -all for maximum protection once you've confirmed all legitimate sources are listed.

Question 4

How do I add Google Workspace to my SPF?

Accepted Answer

Add 'include:_spf.google.com' as a mechanism. This authorizes all Google mail servers to send on your behalf. Each email provider publishes their own SPF include domain.