Suped

What is universal SPF and how does it help fix broken SPF policies?

12Marketer opinions1Expert opinions3Technical articles2Resources

Summary

Universal SPF is presented as a layer 2 extension designed to address broken SPF policies and improve email deliverability by circumventing limitations of the existing SPF protocol, especially the 10 DNS lookup limit. Common SPF errors such as exceeding DNS lookup limits, syntax errors, and incorrect use of 'include' statements can cause 'permerror' results, leading to hard fails. Universal SPF aims to signal receiving servers to allow these policies to still pass or fail as intended, while techniques like SPF flattening can also reduce DNS lookups. However, it's important to note that Universal SPF isn't an officially recognized IETF extension, and the term 'extension' may be misleading. The original SPF was designed to mitigate DOS attacks, and correct configuration is critical to avoid deliverability issues.

Key findings

  • Universal SPF Purpose: Aims to fix broken SPF policies and improve email deliverability.
  • Layer 2 Extension: Presented as a layer 2 extension of SPF.
  • DNS Lookup Limit: Addresses the 10 DNS lookup limit.
  • SPF Errors: Common errors include exceeding DNS lookups, syntax errors, and incorrect 'include' usage.
  • Permerror and Hard Fail: 'Permerror' can lead to hard fails, causing deliverability issues.
  • SPF Flattening: Technique to reduce DNS lookups by replacing 'include' statements.

Key considerations

  • Official Status: Not an officially recognized IETF extension.
  • Terminology: The use of 'extension' may be misleading.
  • Configuration Importance: Correct SPF configuration is critical to avoid deliverability issues.
  • Mitigation Alternatives: SPF flattening and other techniques can also help manage DNS lookup limits.
  • Original Intent: Original SPF design was intended to mitigate DOS attacks.

What email marketers say
12Marketer opinions

Universal SPF is presented as a layer 2 extension to the existing SPF protocol, designed to address limitations and misconfigurations that lead to broken SPF policies. Primarily, it aims to circumvent the 10 DNS lookup limit imposed by the standard SPF, which is often exceeded due to excessive 'include' statements or syntax errors. By providing a mechanism to signal receiving servers to allow 'permerror' policies (those with errors) to still pass or fail as intended, and by potentially using techniques like SPF flattening, universal SPF seeks to improve email deliverability and protect against sending failures caused by SPF misconfigurations or operational concerns like potential DOS attacks from spammers. However, it is also noted that the term 'extension' is contentious, as it is not an officially recognized IETF extension, and there are alternative methods like SPF flattening to mitigate DNS lookup issues.

Key opinions

  • Definition: Universal SPF is a layer 2 extension to SPF that aims to fix broken SPF policies.
  • Purpose: It provides a mechanism for domain operators to signal that broken policies should still return a pass or fail result.
  • Problem Addressed: It addresses the 10 DNS lookup limit in standard SPF, often exceeded by multiple 'include' statements.
  • SPF Errors: Common SPF errors include exceeding DNS lookup limits and syntax errors leading to SPF failures.
  • Alternative Solutions: SPF flattening can also reduce DNS lookups by replacing 'include' statements with IP addresses.
  • Operational Concerns: Original SPF design was to limit DOS attacks from spammers.

Key considerations

  • Official Status: Universal SPF is not an officially recognized IETF extension.
  • Terminology: The use of the term 'extension' may be misleading.
  • Alternative Solutions: Techniques like SPF flattening can also resolve DNS lookup issues.
  • Implementation: Misconfigurations in SPF are common and can lead to deliverability issues.
  • Complexity: Correct SPF configuration is complex and requires attention to detail to avoid errors.
Marketer view

Email marketer from Email Geeks shares an update on a universal SPF extension that protects a domain's delivery against accidents, supported by major providers, adopted by 300+ domains, and fixes broken SPF policies.

May 2022 - Email Geeks
Marketer view

Email marketer from Stack Overflow explains that SPF PermError indicates that the SPF record has syntax errors or exceeds the 10 DNS lookup limit.

October 2022 - Stack Overflow
Marketer view

Marketer from Email Geeks shares an update on a universal SPF extension that protects a domain's delivery against accidents. It's supported by major providers, adopted by 300+ domains, and fixes broken SPF policies.

May 2023 - Email Geeks
Marketer view

Email marketer from Word to the Wise shares that SPF has a lookup limit of 10 DNS queries. Exceeding this limit can lead to SPF failing, impacting deliverability. Universal SPF aims to address this by providing a workaround.

April 2025 - Word to the Wise
Marketer view

Email marketer from Email Geeks explains that universal SPF is a layer 2 extension built on top of SPF, providing a mechanism for domain operators to signal that broken policies should still return a pass or fail result. It translates universal SPF policies back to traditional SPF.

June 2021 - Email Geeks
Marketer view

Marketer from Email Geeks explains that universal SPF is a layer 2 extension built on top of SPF, providing a mechanism for domain operators to signal that broken policies should still return a pass or fail result. It translates universal SPF policies back to traditional SPF.

July 2023 - Email Geeks
Marketer view

Email marketer from EasyDMARC answers shares that common SPF errors include exceeding the 10 DNS lookup limit, syntax errors, and incorrect use of include statements, which leads to SPF failing checks.

March 2025 - EasyDMARC
Marketer view

Email marketer from Mailhardener responds that SPF flattening is a technique to reduce DNS lookups by replacing 'include' statements with the actual IP addresses. This helps to stay within the 10 DNS lookup limit and prevent SPF failures.

November 2022 - Mailhardener
Marketer view

Marketer from Email Geeks clarifies that the issue with SPF implementation is more than a simple bug, but rather there were genuine operational concerns about spammers DOSing receivers and computational issues with large or unlimited lookups.

January 2022 - Email Geeks
Marketer view

Email marketer from Reddit explains that 'include' statements in SPF records count towards the 10 DNS lookup limit. Too many includes can cause SPF checks to fail, which could negatively impact email deliverability.

July 2021 - Reddit
Marketer view

Email marketer from Email Geeks explains that claiming to have an extension to an IETF published specification when you do not is disingenuous. The IETF works on specifications which aid interoperability on the internet, but they do not operate infrastructure.

August 2022 - Email Geeks
Marketer view

Marketer from Email Geeks explains that claiming to have an extension to an IETF published specification when you do not is disingenuous. The IETF works on specifications which aid interoperability on the internet, but they do not operate infrastructure.

December 2024 - Email Geeks

What the experts say
1Expert opinions

An expert from Word to the Wise explains that standard SPF has a hard limit of 10 DNS lookups and Universal SPF has the potential to fix issues due to exceeding the DNS lookup limits where misconfiguration has occurred.

Key opinions

  • SPF Lookup Limit: Standard SPF has a hard limit of 10 DNS lookups.
  • Universal SPF Potential: Universal SPF may address issues from exceeding those limits, especially in misconfigured systems.

Key considerations

  • Misconfiguration Focus: The expert highlights Universal SPF's potential benefit primarily in scenarios where SPF lookup limits are misconfigured.
Expert view

Expert from Word to the Wise explains that SPF has a hard limit of 10 DNS lookups. Universal SPF could potentially address issues arising from exceeding these limits, when those lookup limits are misconfigured.

December 2023 - Word to the Wise

What the documentation says
3Technical articles

SPF documentation highlights that a 'permerror' in SPF records, often due to syntax errors or exceeding DNS lookup limits, results in a hard fail. This signifies that the sending server isn't authorized, which is frequently caused by improper configurations or exceeding the lookup limits defined in the SPF protocol.

Key findings

  • Permerror Definition: A 'permerror' indicates syntax errors or exceeding DNS lookup limits in SPF records.
  • Hard Fail Result: Mail servers treat 'permerror' as a hard fail, meaning the sending server is not authorized.
  • Common Causes: Improper SPF configurations and exceeding DNS lookup limits are common causes of hard fails.

Key considerations

  • Configuration Importance: Proper SPF record configuration is critical to avoid hard fails.
  • Lookup Limits: Staying within the DNS lookup limits defined by the SPF protocol is essential.
  • Syntax Errors: Avoiding syntax errors in SPF records is vital for proper authentication.
Technical article

Documentation from openspf.org explains a permerror result means the SPF record contained a syntax error, such as exceeding the maximum number of DNS lookups. Mail servers will generally treat a permerror as a hard fail.

March 2024 - openspf.org
Technical article

Documentation from rfc-editor.org specifies the syntax and semantics of the Sender Policy Framework (SPF) protocol. It outlines the mechanisms and modifiers used in SPF records and how they are evaluated during SPF checks, including the DNS lookup limitations.

October 2023 - rfc-editor.org
Technical article

Documentation from dmarcian.com explains that an SPF hard fail indicates the sending server is not authorized to send emails on behalf of your domain. This can happen when SPF records are not properly configured or when the lookup limit is exceeded.

June 2021 - dmarcian.com

Related resources
2Resources

Issues with Dmarc and email bouncebacks - Networking ...
Issues with Dmarc and email bouncebacks - Networking ...

Last week we started getting email bounceback messages from a client stating ‘invalid spf record’ . The tech dept for the client says they are seeing this issue from several of its vendors in the past week and its the vendors fix because they need to update their SPF records. However, we use Office 365 and nothings changed with the spf record on our third party host. Dkim is enabled by default even though we don’t have custom records setup for it on the host DNS records. They sent us a domain ...

Spiceworks Community
Office 365 NDR Issue - Cloud Computing & SaaS - Spiceworks ...
Office 365 NDR Issue - Cloud Computing & SaaS - Spiceworks ...

So, my company uses office 365 with exchange online. Lately I have been getting reports from users that alot of them have been getting emails like this. and I am not sure why. Is this because I use direct send via “name-domain.mail.protection.outlook.com” ? or something to do with a txt record in my dns server?

Spiceworks Community

Related questions