Several sending services in one SPF: order instead of the lookup limit
Mail provider, newsletter, shop, CRM — all want into your SPF. How to merge the record, keep the 10-lookup limit in check and when subdomains work better.
A business today rarely sends only through its mail provider: newsletter tool, shop system, invoicing software, CRM, support helpdesk — each one wants to be "quickly added to your SPF". A few years later you have a chain of includes that nobody understands any more and that is scraping against the 10-lookup limit. Here is how to bring order to it.
Ground rule: ONE record, deliberately maintained
beispiel.atv=spf1 include:spf.protection.outlook.com include:servers.mcsv.net -allUnderstanding the 10-lookup limit
Recipients may perform at most 10 DNS lookups during the SPF check: every include, a, mx, exists and redirect counts — and includes also count whatever they look up INTERNALLY. A single include of a large provider can bring three or four lookups with it. If the limit is exceeded, the result is PermError, and many recipients then treat the domain as if it had no SPF at all.
- Take stock: which services are REALLY still sending? Throwing out legacy entries is the most effective step.
- ip4:/ip6: entries cost NO lookups — enter fixed server addresses (your own server, the hosting provider's form mailer) directly instead of via include.
- Use the mx mechanism only when it is needed — it costs a lookup too.
The elegant solution: one subdomain per purpose
Beyond a certain number of services it pays to switch to separate sender subdomains: the newsletter sends as news.beispiel.at, the invoicing software as rechnung.beispiel.at. Each subdomain gets its own short SPF and the DKIM of its service:
news.beispiel.atv=spf1 include:servers.mcsv.net -allAfter every change: have the lookups counted
You cannot tell by looking at a record whether it stays under the limit — the includes have to be resolved recursively. Have it checked once after every change; a good tool counts the lookups along the way and warns before you get a PermError.
Frequently asked questions
Can I create two SPF records if one gets too long?
No — two v=spf1 records on the same name are a permanent error. A long VALUE may technically be split into several 255-character chunks (the DNS interface does that), but it has to remain ONE record.
What does "SPF flattening" achieve?
It replaces includes with the IP addresses currently behind them in order to save lookups. That works — until the provider changes its addresses. Without automated maintenance, flattening is a ticking clock; separating by subdomain and taking stock solve the problem more sustainably.
Does a subdomain sender address hurt trust on the recipient's side?
No — news.beispiel.at is recognisable as your domain, and large brands do exactly the same. The only thing that matters is to set the reply address sensibly so that replies actually arrive.