Hosted SPF

How the delegation works

SPF lives in a TXT record at your apex, and the record most domains publish is a pile of includes: one per provider, each one costing DNS lookups against the limit of ten that receivers enforce. Past ten, receivers return a permerror and read the record as broken.

With hosted SPF you replace that pile with one TXT record carrying one include that points at a name we serve. At that name we publish your senders' addresses as literal ip4: and ip6: terms, resolved by us on a schedule. A receiver spends one lookup on your include and reads plain addresses behind it, so the ten-lookup limit stops being your problem however many senders you add.

The ending stays yours. Your record keeps its own ~all or -all, so you decide what receivers do with mail from an address the list does not cover.

Senders become a list, not a DNS ticket

The sender list lives on the domain's configuration page. Adding a provider is a button: pick it from the catalogue or type any SPF mechanism, and the served record carries its addresses within the minute. Removing one is the same button in the other direction.

Enabling imports the record you already publish, sender by sender, so the switch loses none of them. A record the import cannot keep whole is refused with the reason rather than imported with a sender missing.

Each sender row also shows what your DMARC reports say about it: how much mail matched its addresses over the last 30 days, and whether that mail passed SPF. A sender that stopped sending shows that too, which is how you find the include that no longer earns its place.

Refreshes, and what a bad one cannot do

Providers renumber without telling you, which is why a hand-flattened record rots. We re-resolve every sender's published ranges each hour and publish what we find, and the weekly digest lists every change to the served record. A same-day email about each change is a switch on the account page.

A refresh that fails publishes nothing: the last good ranges keep serving and your mail keeps flowing, and we email you when a failure stands for a day. A scheduled refresh whose result would drop a large share of the served addresses is also not published, because that shape is usually a provider's DNS answering incompletely. It waits for you instead: we email you the day it happens, and one press of Refresh senders applies it when the shrink is real.

If our DNS is ever unreachable, receivers defer your mail with a temporary error and retry. Mail bounces only if the outage holds for longer than their retries.

Leaving takes your record with you

Stop hosting and the page writes out a self-managed record built from your sender list, ready to publish at your apex. We keep answering the include until your published record stops referencing us, and for twenty days after that, so every sender keeps its pass across both edits.

Part of the paid plans

Hosted SPF comes with the paid plans, next to the monitoring the rest of the product does: the weekly digest, realtime alerts and the sender evidence the per-sender signal reads from. The pricing page has the numbers.

Create your account