What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To create SPF, publish one DNS TXT record at the authoritative DNS provider for the domain that appears in your mail’s envelope-from or return-path. Start the value with v=spf1, add every legitimate sending service with its documented mechanism, and finish with an enforcement qualifier such as ~all or -all.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To fix SPF, merge all authorized senders into that single record, remove duplicate v=spf1 records, keep evaluation within the 10-DNS-lookup limit, and allow DNS changes up to 24–48 hours to propagate before retesting.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhat an SPF record does
Sender Policy Framework (SPF) lets a receiving mail server check whether the IP address delivering a message is authorized to send for a domain. Google Workspace defines SPF as a record that identifies the mail servers and domains allowed to send email on a domain’s behalf.
SPF is not a setting inside your mailbox application. It is a DNS TXT record published for the sending domain or subdomain. During delivery, the recipient evaluates the sender’s IP against the mechanisms in that record, including direct IP ranges and references to other domains.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
The domain evaluated by SPF is normally the envelope-from (also called the return-path), which can differ from the address displayed in the visible From: header. A message can therefore look as if it came from your company while SPF is actually checking a service-specific return-path subdomain. Always identify that domain before editing DNS.
SPF syntax
An SPF value has three parts:
- Version:
v=spf1must appear first. - Authorized sources: mechanisms such as
ip4:,ip6:,a,mx, andinclude:. - Result qualifier: commonly
~allfor a soft fail or-allfor a fail when no listed source matches.
For example, v=spf1 ip4:192.0.2.10 include:mail.example.net ~all authorizes one IPv4 address and the senders defined by another domain, then asks receivers to soft-fail everything else.
An include: does not simply trust every message from the named organization. It tells the receiver to evaluate the named domain’s SPF policy and authorize the source only when that evaluation passes. Copy the exact include documented for your account; a similarly named value for another product may not authorize your traffic.
Limits that shape the record
- Publish exactly one SPF record for each domain or subdomain. Multiple TXT values beginning with
v=spf1at the same name cause an SPF error, commonly reported aspermerror. - SPF evaluation allows a maximum of 10 DNS lookups. Nested
includestatements and mechanisms such asa,mx, and redirects can consume that budget. - Google Workspace documents a 255-character SPF-record limit and a 512-byte TXT-file limit. A longer or more complex design must be simplified rather than handled by adding another SPF record.
Unrelated TXT records, such as verification tokens, can remain at the same DNS name. The one-record rule applies to values that contain the SPF version tag, not to every TXT value in the zone.
Prepare before editing DNS
An SPF record is only correct if it accounts for every service that actually sends mail using the domain. Make an inventory before opening the DNS dashboard.
List every outbound sender
- Your primary mailbox platform, such as Google Workspace or Microsoft 365.
- Marketing or newsletter software.
- Support-ticket and help-desk systems.
- Your website server, contact forms, and application mailer.
- CRM, invoicing, billing, and transactional-email services.
- Any separately hosted subdomain used for notifications or bulk mail.
For each service, record the domain used as the envelope-from or return-path. That domain is what SPF evaluates; it may differ from the address a recipient sees in the visible From: line. Ask the provider for its current SPF mechanism and use that exact value. Do not substitute an include: value copied from a different provider.
Check both production and less frequent workflows. Password resets, invoices, contact-form replies, alerts, and support notifications may come from infrastructure that nobody remembers during a mailbox-only setup. A service that sends only once a month still needs authorization when it sends.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Decide which senders are still legitimate
Remove services that no longer send mail. Keeping obsolete includes makes the record harder to audit and can push it over the lookup limit. Do not remove a sender merely because it is infrequent: a rarely used password-reset or billing system still needs authorization when it sends.
Keep a dated copy of the inventory and the final DNS value. When a vendor is replaced, remove its mechanism only after the old service has stopped sending; when a new vendor is added, edit this same record instead of creating a second one.
Create the SPF record step by step
- Find the authoritative DNS provider. Check the domain’s name-server (NS) delegation and sign in to the DNS service that answers authoritatively. If a hosting partner manages the DNS zone, make the change in that partner’s dashboard rather than in a separate DNS account.
- Open the TXT-record form. The usual path is DNS → Add record → TXT. For a root domain, many dashboards use
@as the record name. A subdomain must use the owner name assigned to that subdomain, such asnotifyfornotify.example.com. - Enter one complete value. Begin with
v=spf1, append the documented mechanism for every legitimate sender, and end with the chosen qualifier. Keep all mechanisms in this one value. - Save the record. Do not create a second TXT record simply because another service needs to be added. Edit the existing value and append the new mechanism.
- Check for duplicates. Review every TXT value at the same owner name. There must be only one value whose first tag is
v=spf1; unrelated TXT records are allowed. - Verify and test. Query the authoritative DNS server, query more than one public resolver after propagation, send a controlled message, and inspect its
Authentication-Resultsheader for the SPF result.
Some DNS interfaces display a root record as the full domain while others require @. Follow the field’s convention exactly. Entering the full domain into a host-label field can publish the record at a name such as example.com.example.com, where receivers will never look for it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Provider-specific SPF examples
The following strings are starting points for the stated configurations, not universal values. Add the mechanisms required by any other service that sends for the same domain and remove senders that have been retired.
| Sending setup | Example SPF value | Ending qualifier | What to change |
|---|---|---|---|
| Google Workspace only | v=spf1 include:_spf.google.com ~all |
Soft fail | Add mechanisms for every other legitimate sender. |
| Microsoft 365 only | v=spf1 include:spf.protection.outlook.com -all |
Fail | Use this Microsoft-documented include only for Microsoft 365 mail. |
| Google Workspace and Microsoft 365 | v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all |
Soft fail | Append any marketing, website, support, or transactional sender to this same value. |
The qualifier is an operational choice. A soft fail (~all) tells a receiver that an unmatched source is suspicious but may still be accepted. A fail (-all) requests rejection or strict treatment of an unmatched source. Choose the policy that matches your deployment state and the provider’s guidance; changing the qualifier does not authorize an otherwise missing sender.
Do not combine the examples mechanically if your organization has additional senders. For instance, a Google Workspace mailbox and a marketing platform require the Google include plus the marketing provider’s documented mechanism in one value. Conversely, do not leave an old Microsoft 365 include after migration if Microsoft 365 no longer sends for the domain.
Fixing multiple SPF records
Two or more SPF TXT records at one domain or subdomain cannot be evaluated as a combined policy. Receivers may return a permanent error instead of selecting one record.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
How to identify the duplicate
- Query the name that appears in the sender’s envelope-from or return-path.
- List every TXT response and mark each value beginning with
v=spf1. - Compare the mechanisms in those values with your sender inventory.
dig +short TXT example.comFor an authoritative check, first identify the domain’s name server, then query it directly:
dig @ns1.example-dns.net TXT example.comReplace the server and domain with your own values. A Windows administrator can use nslookup -type=TXT example.com.
How to merge them safely
- Keep a copy of the current records so you can recover if a sender was overlooked.
- Combine every required
include:,ip4:, andip6:mechanism into one value beginning withv=spf1. - Use one final qualifier at the end; do not place
~allor-allin the middle. - Delete the other SPF TXT values at that same owner name.
- Recheck the lookup count and record length before saving.
For example, if one record contains v=spf1 include:_spf.google.com ~all and another contains v=spf1 include:spf.protection.outlook.com ~all, replace both with v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all. This works only when those are the complete set of legitimate senders; add any other required mechanisms to the merged value.
Fixing the “too many DNS lookups” error
SPF processing is limited to 10 DNS lookups. A visible include: can reference another SPF record that contains more includes, so the total is recursive rather than just the number of terms you can see. a, mx, and redirect mechanisms can also require DNS queries.
Recommended Free Tools
Reduce the lookup budget
- Remove obsolete senders. Delete includes for services that no longer send mail.
- Audit nested includes. Ask each provider which mechanisms its published record expands into and identify repeated or unnecessary references.
- Prefer the provider’s simplest supported mechanism. If a vendor documents a direct include for your plan, do not add separate mechanisms that duplicate it.
- Use maintained IP ranges only when appropriate. Replacing a lookup with explicit IP ranges can reduce DNS use, but you must monitor the provider’s published ranges and update them whenever they change.
- Consider provider-supported flattening. A flattening design can publish resolved addresses, but it must refresh when the provider changes its infrastructure. Verify that the design is supported and maintained before relying on it.
- Recount after every edit. A record that works today can exceed the limit after a vendor adds a nested include.
Do not solve a lookup error by publishing a second SPF record. That trades one failure for a duplicate-record permerror. Also avoid deleting a nested mechanism blindly: the apparent extra lookup may authorize a service that still sends critical mail. Identify the sender first, then simplify the policy while preserving coverage.
When SPF is “not found” or not working
When a receiver reports no SPF record, start with the DNS location and owner name rather than repeatedly changing the value.
Check the authoritative location
- Confirm that the domain’s name servers point to the DNS service you edited.
- If a hosting partner manages the zone, edit the partner’s zone; a separate DNS dashboard may not be authoritative.
- For the root domain, try the dashboard’s
@owner name. Do not enter the full domain in a field that expects only a host label. - For a subdomain, publish the record at that exact subdomain, not automatically at the root.
Check the value’s syntax
- The value must start exactly with
v=spf1. - Remove accidental line breaks, pasted formatting, and extra quotation marks added as literal characters.
- Ensure the final qualifier is attached to the same SPF value as the mechanisms that precede it.
- Look for a second
v=spf1TXT value that was created by an earlier setup.
Query both the authoritative server and public resolvers. If the authoritative answer is correct but public resolvers still show the old value, the issue is propagation rather than syntax.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Why legitimate messages still fail SPF
A passing result depends on the service that actually transmitted the message. If a website, CRM, support system, or marketing platform sends through its own infrastructure, the mailbox provider’s include alone will not authorize it.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →- Inspect the message’s headers and identify the envelope-from or return-path domain used for SPF.
- List the application or service that delivered the message, not just the address displayed to the recipient.
- Read that provider’s current SPF documentation and copy its documented
include:or IP mechanism. - Add the mechanism to the existing SPF value at the matching domain or subdomain.
- Send another controlled test after DNS propagation and inspect
Authentication-Results.
Cloudflare publishes example values for Google Workspace, Microsoft 365, and iCloud Mail that can help you compare a suspected configuration, but the sender’s own documentation is the authority for its current infrastructure.
If only one class of message fails, compare its return-path with a message that passes. Different subdomains often have different SPF policies, so correcting the root-domain record may not affect a notification subdomain. Make the change where the failing message’s envelope domain is published.
How long SPF changes take to work
Google Workspace says SPF authentication can take up to 48 hours after a record is added. In practice, an authoritative query may show the new value before every public resolver has refreshed its cached answer.
- Query the authoritative server immediately after saving to confirm the intended value was published.
- Wait 24–48 hours before treating a public result as final.
- Query more than one public resolver because caches expire at different times.
- Retest a controlled message only after the DNS answers are consistent.
- Avoid repeated edits during the waiting period; each change can create another propagation interval and make diagnosis harder.
A message sent during propagation can legitimately receive an old SPF result from one resolver and a new result from another. Record the resolver response and test time when troubleshooting so you can distinguish a cached answer from a persistent configuration error.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteSPF, DKIM, and DMARC belong together
SPF authenticates the sending infrastructure associated with the envelope domain. It is one layer, not a complete anti-spoofing system. Microsoft advises deploying DKIM and DMARC as complementary controls because spoofing techniques can bypass reliance on SPF alone.
- SPF: publishes which sending infrastructure is authorized.
- DKIM: adds a cryptographic signature that receiving systems can verify against a DNS key.
- DMARC: lets the domain owner publish handling and reporting instructions and evaluate alignment with the visible From domain.
Configure these controls for the domains and subdomains that send mail, then monitor authentication results before tightening enforcement. A correct SPF record does not replace DKIM or DMARC.
Final verification checklist
- Every legitimate outbound service is inventoried, including low-volume applications.
- The record is published at the authoritative DNS provider and the correct owner name.
- There is exactly one TXT value beginning with
v=spf1at that name. - Each provider’s documented mechanism is used for that provider, with no copied value intended for another service.
- The complete policy stays within 10 DNS lookups and the documented character and TXT-size limits.
- The value begins with
v=spf1, uses one final qualifier, and contains no accidental formatting characters. - Authoritative and public DNS queries return the intended value after propagation.
- A controlled message shows the expected SPF result in its
Authentication-Resultsheader. - DKIM and DMARC are configured as additional authentication layers.
Frequently Asked Questions
How do I create an SPF record for my domain?
Identify every service that sends mail, find the authoritative DNS provider, and add one TXT record at the root or sending subdomain. Start with v=spf1, add each provider’s documented include: or IP mechanism, and finish with ~all or -all. Verify that no second v=spf1 value exists.
How do I fix multiple SPF records?
Query the exact envelope-from or return-path domain, list all TXT values beginning with v=spf1, and merge the required mechanisms into one value. Keep one final qualifier at the end, delete the other SPF values, then recheck lookup count and propagation.
Why is my SPF record failing?
Common causes are an incorrect DNS host, the wrong owner name, a missing sender include, malformed text, duplicate SPF values, or a message sent from a different return-path domain than expected. Query the authoritative server, inspect the message’s Authentication-Results header, and use the transmitting provider’s current mechanism.
How do I fix the SPF too many DNS lookups error?
Stay within the 10-lookup evaluation limit by removing obsolete senders, reducing nested includes, avoiding redundant a and mx mechanisms, and using provider-supported flattening or maintained IP ranges when appropriate. Recount after each change and never add a second SPF record.
What SPF record should I use for Google Workspace or Microsoft 365?
For Google Workspace alone, Google documents v=spf1 include:_spf.google.com ~all. Microsoft 365 documents v=spf1 include:spf.protection.outlook.com -all. If both send for the same domain, combine both includes in one record and append mechanisms for every other legitimate sender.
How long does an SPF record take to work?
Google Workspace says authentication can take up to 48 hours after publication. Confirm the authoritative answer first, wait 24–48 hours, check more than one public resolver, and then send a controlled test. Avoid repeated edits while caches are still updating.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Can I publish more than one SPF TXT record if my value is too long?
No. Multiple SPF values at one owner name can produce a permanent SPF error. Remove obsolete mechanisms, simplify nested references, or use a supported maintained design while staying within the documented 255-character and 512-byte limits.
Do SPF, DKIM, and DMARC replace one another?
No. SPF authorizes sending infrastructure, DKIM verifies a cryptographic signature, and DMARC applies policy and alignment checks for the visible From domain. Configure all three for a layered authentication deployment.
The Bottom Line
Publish one SPF TXT record at the authoritative DNS provider for each sending domain or subdomain. Merge every legitimate sender using its documented mechanism, keep evaluation below 10 DNS lookups and within the record-size limits, verify the exact DNS name and value, wait up to 24–48 hours for propagation, and use DKIM and DMARC alongside SPF.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
