SPF with WebMon

SPF: the allowlist of who may send email for your domain.

SPF publishes in your DNS the servers authorized to send on behalf of your domain. A poorly built record — too many lookups or a permissive 'all' — lets spoofing through or breaks delivery. WebMon validates your SPF and keeps it within the standard's limits.

Home · Email security · SPF

In short

What is SPF?

What it is

SPF (Sender Policy Framework) is a public standard published as a TXT record on your domain. Using mechanisms like ip4, ip6, include and a, it lists the sources authorized to send mail from your domain.

How it works

On receiving a message, the destination server queries the SPF record of the envelope-from domain and checks whether the sending IP is authorized. Based on the result — pass, fail, softfail — it decides to accept, flag or drop the message.

Who it's for

Any domain that sends mail, especially if it uses several third-party services — CRM, invoicing, marketing — that send in its name and must be correctly included in the record.

What problem it solves

It prevents unauthorized servers from sending using your domain in the envelope and helps keep your legitimate mail from being marked as spam. It is one of the two pillars DMARC evaluates.

Capabilities

A valid SPF, within the limits

10-lookup limitDetects when your record exceeds the 10 allowed DNS lookups.
Authorized sourcesCross-checks your includes with the real sources seen in DMARC.
Correct syntaxReviews the final 'all' and avoids permissive or duplicate records.
Guided remediationSuggests the optimal record and helps apply it in your DNS.

Common mistakes

SPF failures WebMon catches

FAQ

Frequently asked questions

What is the SPF 10-lookup limit?

The SPF standard allows a maximum of 10 DNS queries when evaluating the record. Exceeding it produces a 'permerror' that invalidates your SPF; that is why flattening unnecessary includes helps.

Can I have two SPF records?

No. The domain must have a single SPF record; two SPF TXT records cause a permanent error. All mechanisms must be combined into one line.

Does SPF alone stop spoofing?

Not entirely: SPF validates the envelope domain, not the one the user sees in the From. That is why it is combined with DKIM and enforced with DMARC to cover the visible address.

How does WebMon validate my SPF?

WebMon checks the syntax, counts the lookups, cross-references your includes with the real DMARC sources and suggests the correct record, supported by the SGS 24/7 SOC in Costa Rica.

Check your SPF record before it breaks your mail.

Diagnose your domain with WebMon and detect exceeded lookups and missing sources.

Diagnose your domain with WebMon