SPF (Sender Policy Framework)
A TXT record that lists which servers are allowed to send email from your domain. The first of the three email-authentication standards (SPF, DKIM, DMARC).
SPF (Sender Policy Framework) is a DNS TXT record that lists the IP addresses and hostnames authorized to send email claiming to be from your domain. Email receivers (Gmail, Outlook, etc.) check the sender's IP against this list and reject mail that doesn't match.
What an SPF record looks like
example.com. TXT "v=spf1 include:_spf.google.com include:sendgrid.net ip4:198.51.100.42 -all"
Reading left to right:
v=spf1— this is an SPF v1 record.include:_spf.google.com— also allow whatever Google's SPF record allows.include:sendgrid.net— also allow whatever SendGrid's SPF record allows.ip4:198.51.100.42— also allow this specific IP.-all— reject everything else.
The 10-lookup limit
SPF has a strict limit: a single record can perform at most 10 DNS lookups during evaluation. Every include:, a:, mx:, ptr:, exists: counts. If you exceed 10, the receiver treats your SPF as permerror and may reject your mail.
This limit is the #1 reason SPF records "stop working" silently. Adding a new email vendor (SendGrid → Mailgun → Customer.io → Postmark) can push you over 10 and break authentication for everyone.
SPF flattening
The standard fix is "SPF flattening": resolve all the include: records server-side and rewrite your SPF record with the actual IPs. Tools that do this: EasyDMARC, MxToolbox flattening services, or DIY scripts that resolve and rewrite weekly.
Trade-off: flattening means your SPF record has to be updated whenever any included vendor changes their IPs. Most teams run a weekly automated flatten + commit.
Why this matters for SaaS custom domains
If your SaaS sends email on behalf of customers from their custom domains (hello@janesbakery.com), you must be in their SPF record. Either by include:_spf.yourapp.com or by direct IP. If you're not, your mail goes to spam.
Provide an SPF setup instruction with every custom domain onboarding. Make sure your customers know to add it.