What is an SPF record, and why does your cold email need one?
In short: An SPF record is a line in your DNS that lists which servers are allowed to send email for your domain. When a mailbox provider receives your mail, it checks the sending server against this list. If the server is not authorised, the message looks like spoofing and is far more likely to land in spam. SPF also has a hard cap of 10 DNS lookups, and going over it quietly breaks authentication.
On this page
What does an SPF record do?
SPF stands for Sender Policy Framework. An SPF record is a single DNS TXT record that starts with v=spf1 and names every server or service allowed to send email as your domain. When your message arrives, the receiving server reads the SPF record and checks whether the connecting server is on the list. If it is, the message passes SPF. If it is not, it fails, and failing SPF is one of the clearest signals of a forged sender.
What does an SPF record look like?
A typical SPF record reads like this:
v=spf1 include:_spf.google.com include:sendgrid.net ~all
Breaking it down: v=spf1 declares the version, each include: authorises another service's servers, and the final ~all is the policy for everything else. ~all means "soft fail" (accept but mark suspicious), while -all means "hard fail" (reject). Most senders start with ~all and tighten to -all once they are confident every sender is listed.
What is the SPF 10-lookup limit?
This is the rule that catches most people out. SPF allows a maximum of 10 DNS lookups when it evaluates your record. Every include:, a, mx, ptr and redirect can trigger one or more lookups, and nested includes add up fast. Go over 10 and SPF returns a permerror, which means it fails even though your record looks fine. A good SPF Checker counts these lookups for you so you can catch the problem before mailbox providers do.
Why SPF matters most for cold email
Cold email sends from new domains with no reputation, so every trust signal counts. SPF is the cheapest, fastest one to get right. A domain that passes SPF, DKIM and DMARC looks like a real business. A domain failing SPF looks like a spammer spoofing someone else, which is exactly the profile filters are trained to catch. If you run outreach across several sending tools, SPF also keeps you honest about which services are actually authorised to send as you.
Check your SPF record free
Validate your SPF syntax, see the policy, and count your DNS lookups against the 10-lookup limit in one click.
Open the SPF Checker →All free tools