What is SPF?
SPF (Sender Policy Framework) is a TXT record on your domain that lists the mail servers and services allowed to send email as that domain. It starts with v=spf1 and usually ends with -all or ~all.
Example
A domain that only sends through Microsoft 365:
@Valuev=spf1 include:spf.protection.outlook.com -all@ means the domain itself. Some DNS hosts want the name field left empty.
The rules that matter
A domain may only have one SPF record. Two records make SPF invalid.
At most 10 DNS lookups. Every include, a, mx, redirect and exists counts, including those nested inside other includes.
-all means other servers are not allowed. ~all means mail from others is suspicious. Never use +all.
Common questions
Can I have two SPF records?
No. Two SPF records make SPF invalid (permerror). Merge them into one record with all the includes.
What happens if I go over 10 lookups?
SPF returns an error and receivers treat the record as invalid. Remove services you no longer use before reaching for more complex fixes.