Deliverability runbook · Intermediate · 15 minutes
SPF: One Record, Ten Lookups, One Verdict
Your mail is being filtered, the record looks perfect on screen, and nobody has told you it is quietly returning permerror.
The short answer
SPF is a single TXT record at your domain root naming every host allowed to send as you, and the number that decides whether it works is ten: the DNS lookups a receiver will follow before it abandons the evaluation and returns permerror.
Everything below is written to be measured. You count your own lookups with a validator, publish exactly one record, and confirm the outcome in the Authentication-Results header of a message that was actually delivered — not in a green tick on a settings page.
By the HostingFast team · Reviewed 12 August 2026
Intermediate
Difficulty grade
15 minutes
Hands-on time
5
Stages
24/7
Engineer cover
This assumes you can open a DNS zone and read a raw message header. It covers the mechanism — what a receiving mail server does with the record — before it covers the clicks, because SPF failures are almost never typing errors.
Every figure here comes from the specification or from a check you can run yourself in under a minute. Where the platform publishes part of the record for you, it says so rather than handing you work already done.
What the receiving server actually does
A receiver takes the envelope sender domain, queries its TXT records, and walks the mechanisms left to right until one matches the connecting IP. Every include:, a:, mx: and redirect= costs a DNS lookup, and the specification caps that walk at ten before the evaluation is abandoned.
That cap is why SPF breaks in ways that look like nothing at all. The record is syntactically perfect, resolves fine when you check it by hand, and still returns permerror on the eleventh query — which most receivers treat as no policy whatsoever.
Counting your lookups before a receiver does
Paste the record into an SPF validator and read the lookup total rather than the pass or fail. Three or four include: mechanisms from mainstream senders routinely expand to eight or nine, because each of those includes pulls in a nested set of its own.
Under ten is the requirement; seven or fewer is where you want to sit, so that a supplier adding one hostname to their record does not tip you over without telling you. If you are already above the line, flatten the most stable sender into explicit ip4: ranges, which cost no lookups at all.
The pass that still fails: alignment
SPF authenticates the envelope sender, which is not the From: address your recipient reads. A newsletter platform can pass SPF against its own bounce domain all day while DMARC alignment fails against yours, and the message lands in spam regardless.
Read the Authentication-Results header on a message that arrived. It prints spf=pass next to the domain that passed. If that domain is not yours, the repair belongs in the sending platform's custom-domain or DKIM settings, not in another include.
What the platform publishes without being asked
With DNS hosted here, cPanel's Email Deliverability page writes and maintains the portion of the record covering our own outbound servers, and marks the domain amber the moment the published record stops matching what the server sends as. That removes the commonest source of silent drift.
Everything past that — the third-party senders only you know about — stays yours to add. If the validator and the panel disagree, support will read a header dump with you at any hour rather than pointing at an article.
The platform these checks were run against
Every screen and command here was exercised on the stack we actually operate: cPanel, LiteSpeed, NVMe storage, one-click installs. There is no allowance for your host being different, because this is the host.
The rate you sign up at is the rate you renew at, so the second year costs exactly what the first did and the line in your accounts stays a fixed number.
- Mechanism first, clicks second
- Every figure sourced or checkable
- A verification step on every job
- Engineers on shift at any hour
Why HostingFast
Standard on every plan
Read it from the headers
Every check here ends in a header line you can read yourself: spf=pass, and the domain it passed for.
The ten-lookup ceiling, in figures
The limit that breaks most records is stated, measured and given a safety margin rather than mentioned in passing.
Alignment explained, not assumed
Envelope sender against From: address is the distinction the whole topic turns on, so it gets a section rather than a footnote.
5 stages, no filler
Five stages, each one a discrete change you can verify before moving to the next.
Panel work already done
Our own sending hosts are published and kept current for you, leaving only the senders we cannot see.
Support that reads headers
Paste the raw Authentication-Results line at three in the morning and an engineer reads that line, not a script.
Quick Start
From order to online
- 1
Enumerate senders from evidence, not memory
Pull a month of Sent items and any DMARC aggregate reports you already receive. Guessing the sender list is how the forgotten invoicing tool starts failing six weeks after you declared the job done.
- 2
Write one record, softfail at the end
v=spf1, then the mechanisms, then ~all. Softfail while you are still discovering senders; -all is a decision you make once monitoring has gone quiet, never on day one.
- 3
Publish exactly one TXT record on the root
Two SPF records evaluate as permerror rather than as a union. When a new service tells you to add an SPF record, what it means is edit the one you have.
- 4
Count the lookups and leave headroom
Run the finished record through a validator and read the DNS lookup total. Trim or flatten until it sits at seven or fewer, so somebody else's change cannot silently push you past ten.
- 5
Confirm from a delivered message
Send to an external mailbox and open the original. Authentication-Results should show spf=pass with your own domain named. That header is the receipt; the settings page is not.
Built In
Loaded onto every plan
- Mailboxes on your own domain, included with the plan
- Spam and virus screening on every mailbox as standard
- IMAP, POP, SMTP and browser webmail on every mailbox
- Engineers on shift every hour of every day, not a queue that opens at nine
- cPanel — the panel most of the industry already automates against
- NVMe SSD storage on every tier, not just the expensive ones
- LiteSpeed caching in the server itself, not bolted on by plugin
- Daily backups with restores you trigger yourself from the panel
- Free SSL on every plan, renewed automatically before it can expire
- Renewal billed at the rate you first signed up at
Frequently Asked
What people ask us most often
My record looks correct but validators report permerror — what causes that?
Almost always the ten-lookup ceiling, or a second SPF record left behind by a service you stopped using. Count the lookups first, then confirm that exactly one TXT record on the root begins v=spf1. Both faults produce a perfectly readable record that receivers treat as no policy at all.
Do ip4 and ip6 mechanisms count against the lookup limit?
No. Literal address mechanisms are evaluated without a DNS query, which is why flattening a stable sender into explicit ranges is the standard way to buy headroom. The cost is maintenance: if that provider renumbers, your record is wrong until somebody notices.
Which panel do accounts run, and does the tooling transfer?
cPanel — the panel most of the industry standardised on long ago. Every tutorial you find online will match your screen, your backups restore onto any other cPanel host, and the skills transfer for life. Plesk and DirectAdmin are available on specific plans if you prefer either.
How quickly can a site be serving traffic from a cold start?
Fast — think minutes rather than days. Your account activates the second payment clears, the domain (free for the first year on annual plans) connects immediately, and the one-click installer has WordPress or any of 240+ applications running before your coffee cools. Got a site somewhere else already? Send us the details and we migrate it free, normally within a day.
Keep reading
How to Take Payments Online
Card data kept off your own server, with the latency each checkout route adds weighed up.
How to Create a Contact Form
A form that submits quickly and a notification that survives the trip to an inbox.
MX Record (Glossary)
The record that decides where inbound mail lands, defined in one screen.
Website Builder
Drag-and-drop building on the same NVMe stack, not a slower sandbox alongside it.
Domain Names
Register or move a name — the first year is included with an annual plan.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Send from hardware that keeps up.
SSL, migration, backups and mailboxes are in the plan rather than on the invoice — and support answers.
View Website Builder plans