Engineering Glossary · Deliverability
SPF: One Record, Ten Lookups, No Second Chances
Adding one more sending service is how a working SPF record turns into a permerror, and nothing in your mail flow announces it.
The short answer
SPF is a single DNS TXT record listing the servers permitted to send for your domain, and receivers evaluate it against the IP address that actually connected to them.
The failure mode that catches technical teams is not a typo. It is the ten-lookup ceiling: every include, a, mx, ptr and exists mechanism costs a DNS lookup, nested includes count towards the same budget, and going over produces a permerror that receivers treat as a failure. So the record that worked perfectly with three services can break silently on the day you add the fourth, and the only way to know is to count.
By the HostingFast team · Reviewed 12 August 2026
100+
Terms in the glossary
2 min
Average read time
Plain
English throughout
24/7
Humans if you get stuck
The record lives in one TXT entry, and there must only ever be one. It lists your genuine sources — hosting mail servers, newsletter platform, CRM — usually through include mechanisms, and closes with a marker saying how harshly to treat everything else.
What it inspects is the delivering server, not the message. That is why forwarding breaks it, why DKIM exists as the cryptographic counterpart, and why DMARC sits above both deciding what the combined result actually means.
Read the record before you edit it
dig +short TXT yourdomain.com returns every TXT record on the name; the SPF one is whichever starts with v=spf1. Do this before any change, because the most common self-inflicted outage in this area is publishing a second SPF record alongside an existing one. Two records do not merge, they void each other, and the domain is then treated as having broken SPF outright.
While you are there, note the ending. A tilde before all is softfail — treat anything unlisted as suspect. A minus is hardfail — reject it. Start soft while you establish who genuinely sends for you, then tighten once reporting confirms the list is complete.
Counting to ten, and why you will not get there by eye
Each include, a, mx, ptr and exists mechanism costs one DNS lookup during evaluation. The catch is that an include pointing at a provider may itself contain three more includes, and those count against your budget rather than theirs. A record with four visible includes can easily consume eleven lookups once expanded.
Check it with a validator that expands the tree and prints a count, and check it again after adding any service. Over the limit, receivers return permerror, and a permerror is not a warning — it is a fail. Flattening the record into literal ip4 and ip6 mechanisms fixes the count, at the cost of taking on responsibility for IP ranges the provider may change without telling you. Flatten only what you are willing to monitor.
What SPF structurally cannot do
SPF authenticates the envelope sender against the connecting IP. It says nothing about the From address a human reads, which is why a message can pass SPF while displaying anybody's name in the client. Tying the authenticated identity to the visible one is DMARC's alignment check, not SPF's job.
It also cannot survive a forwarding hop. Once a forwarder relays your message, the connecting server is theirs, so the check runs against an IP that was never in your record. That is not a bug to be configured around; it is the reason DKIM signs inside the message, where a relay cannot invalidate it.
Where this lands on HostingFast
DNS records are editable from the control panel, so publishing and amending the record is a two-minute job rather than a ticket. The rate you sign up at is the rate you renew at, so year two costs exactly what year one did — no ambush waiting in the invoice.
Follow-on entries: DKIM for the half that survives forwarding, DMARC for the policy above both, TXT Record for the container, and SMTP for the dispatch path itself.
Definitions written for people who deploy
Every entry here started life as a support ticket. Rather than explain the same term for the two hundredth time, we wrote it down properly — with the command that checks it and the limit that bites.
Already hosted somewhere slower? We migrate the whole site free, usually within 24 hours, and it keeps serving visitors the entire time.
- 100+ entries, each with the mechanism spelled out
- Commands you can paste, numbers you can compare against
- Neighbouring terms wired together at the foot of every page
- Written by the engineers who answer the tickets
Why HostingFast
Standard on every plan
Hard limits named
Where a specification imposes a ceiling — ten lookups here — the entry names it instead of describing it vaguely.
Read before write
Every DNS entry starts with the dig command that shows you what is live, because editing blind is how records get duplicated.
Mechanism, not vocabulary
How the check actually runs at the receiver, since that is what decides whether your mail is trusted.
The silent failure flagged
Deliverability faults do not raise errors on your side. Each entry says what the failure looks like from the outside.
Wired to its neighbours
SPF runs into DKIM, DMARC and TXT Record — three terms that only make sense together.
This term, landed
SPF defined, counted, bounded and located in your own DNS — enough to audit a record this afternoon.
Quick Start
From order to online
- 1
Dump what is published
dig +short TXT yourdomain.com and find the v=spf1 entry. If there are two, that is the fault and nothing else needs investigating yet.
- 2
Expand and count the lookups
Run the record through a validator that follows nested includes and prints a total. Anything at or over ten needs consolidating before the next service is added.
- 3
Prove it at a receiver
Send to a mailbox you control and read Authentication-Results in the message source. spf=pass is evidence; a green tick in a plugin is not.
Built In
Loaded onto every plan
- Mailboxes on your own domain, included with the plan
- cPanel's DNS Zone Editor, not a fixed set of preset records
- LiteSpeed caching built into the server rather than bolted on by plugin
- NVMe SSD storage on every tier, not only the expensive ones
- Zero setup charges — there is no joining fee, ever
- Year one of your domain free when you order annually
- Money-back cover: 30 days on hosting plans, 7 on reseller
- Staging environments, so a change gets measured before it ships
- WebP image conversion built in, at no extra cost
- Free SSL on every plan, renewed automatically before it can lapse
Frequently Asked
What people ask us most often
How do I count the DNS lookups my SPF record uses?
Not by eye, because nested includes are invisible in the record itself. Use a validator that expands the whole tree and prints a total; each include, a, mx, ptr and exists mechanism costs one, and a provider's include can add three more of its own. Anything at or above ten produces a permerror at receivers, which is a fail rather than a warning.
Why did adding one more sending service break SPF entirely?
Two likely causes. Either the new service published a second SPF record, which voids both, or its include pushed the expanded lookup count past ten. Check with dig first for a duplicate record, then run the expansion count. Consolidating into one record and flattening the most stable provider back to explicit ip4 ranges usually recovers the budget.
Does SPF cover the From address a recipient actually sees?
No, and this is the most common misunderstanding about it. SPF checks the envelope sender against the connecting IP address. The visible From header is untouched by that check, which is why mail can pass SPF and still be a convincing forgery. Tying the two together is DMARC's alignment requirement, and it is the reason DMARC exists at all.
If we leave, what comes with us?
Everything. Download a full backup from the panel whenever you like, before or during cancellation. Domains remain registered in your name for the term you paid for and can transfer to any registrar once the standard 60-day window passes. Nothing here is engineered to make an exit awkward.
Keep reading
DKIM (DomainKeys Identified Mail)
The cryptographic half of the pair — the one a forwarding hop cannot invalidate.
SMTP
The dispatch path itself, and where its latency ends up if you send inside a request.
How to Publish a DMARC Policy
Publishing a DMARC policy in the order that does not bounce your own invoices.
WordPress Hosting
WordPress on LiteSpeed with staging and daily backups — tuned rather than merely supported.
DirectAdmin Reseller Hosting
Lightweight DirectAdmin reseller hosting at a lower monthly rate.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
DNS you can edit without a ticket.
Full record control in the panel, mailboxes included with the plan, and renewals billed at the rate you first signed up at.
View WordPress Hosting plans