Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've hit a snag with SPF. The SPF record for my domain will contain four or five entries, plus it will contain:

The SPF record for contains eleven entries! This, plus mine, is way over the maximum ten allowed by the RFC (and probably by most servers). I realize that there has to be a limit in order to prevent DoS attacks. However, in the real world, it is probably not unreasonable for large companies to have many server addresses.

Furthermore, must I know monitor my 'include:' counterparts for changes and additions? Must I check weekly, daily, to insure that some combination of changes doesn't suddenly put me over the top? It doesn't seem to me that SPF is suitable for prime time.

Is there another way to do this?

share|improve this question

Why do you inclide IP addresses at all?

You can include networks, domain names, mx entries - there is no need to put in a single individual IP address.

share|improve this answer

If you're hitting the limit for SPF records, then you're probably doing something wrong. Consider using:

  • "a" shortcut
  • "mx" shortcut
  • Subnets

An very common tactic is to list all of your potential mail exchangers as MX entries for that domain but with an extremely high priority number. Since MXes for a domain are picked in order from lowest to highest, it means that the server will never be selected to receive traffic, but will be listed as being allowed to send traffic. This improves deliverability even for destinations that don't support SPF. Just be sure to include "mx" in your SPF list.

share|improve this answer

Correct me if I am wrong, but I thought it was just 10 DNS lookups. I didn't think ip addresses counted for that. looks like it has just 5:, a, mx,, and

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.