Error: SPF record must be in the correct format

Clash Royale CLAN TAG#URR8PPP

up vote
1
down vote

favorite

I need some help with set up the SPF record. When I created the SPF record just like this:

v=spf1 a mx include:_spf.google.com include:getresponse.com ~all

When I run this for a test:

https://toolbox.googleapps.com/apps/checkmx/check?domain=workwithchrisonline.com&dkim_selector=

Obviously it give me an error: SPF record must be in the correct format.

I have also tried this:

"v=spf1 +a +mx +ip4:104.xxx.xxx.xxx +include:_spf.google.com +include:getresponse.com ~all"

I dont know why I get an error. Are there anything you can do to help me how I can solve this?

domain-name-system email email-server spf dns-zone

share|improve this question

asked 7 hours ago

Robert Jones

61

New contributor

Robert Jones is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

add a comment | 

up vote
1
down vote

favorite

I need some help with set up the SPF record. When I created the SPF record just like this:

v=spf1 a mx include:_spf.google.com include:getresponse.com ~all

When I run this for a test:

https://toolbox.googleapps.com/apps/checkmx/check?domain=workwithchrisonline.com&dkim_selector=

Obviously it give me an error: SPF record must be in the correct format.

I have also tried this:

"v=spf1 +a +mx +ip4:104.xxx.xxx.xxx +include:_spf.google.com +include:getresponse.com ~all"

I dont know why I get an error. Are there anything you can do to help me how I can solve this?

domain-name-system email email-server spf dns-zone

share|improve this question

asked 7 hours ago

Robert Jones

61

New contributor

Robert Jones is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

add a comment | 

up vote
1
down vote

favorite

up vote
1
down vote

favorite

I need some help with set up the SPF record. When I created the SPF record just like this:

v=spf1 a mx include:_spf.google.com include:getresponse.com ~all

When I run this for a test:

https://toolbox.googleapps.com/apps/checkmx/check?domain=workwithchrisonline.com&dkim_selector=

Obviously it give me an error: SPF record must be in the correct format.

I have also tried this:

"v=spf1 +a +mx +ip4:104.xxx.xxx.xxx +include:_spf.google.com +include:getresponse.com ~all"

I dont know why I get an error. Are there anything you can do to help me how I can solve this?

domain-name-system email email-server spf dns-zone

share|improve this question

asked 7 hours ago

Robert Jones

61

New contributor

Robert Jones is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

I need some help with set up the SPF record. When I created the SPF record just like this:

v=spf1 a mx include:_spf.google.com include:getresponse.com ~all

When I run this for a test:

https://toolbox.googleapps.com/apps/checkmx/check?domain=workwithchrisonline.com&dkim_selector=

Obviously it give me an error: SPF record must be in the correct format.

I have also tried this:

"v=spf1 +a +mx +ip4:104.xxx.xxx.xxx +include:_spf.google.com +include:getresponse.com ~all"

I dont know why I get an error. Are there anything you can do to help me how I can solve this?

domain-name-system email email-server spf dns-zone

domain-name-system email email-server spf dns-zone

share|improve this question

asked 7 hours ago

Robert Jones

61

New contributor

Robert Jones is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

share|improve this question

asked 7 hours ago

Robert Jones

61

New contributor

Robert Jones is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

share|improve this question

share|improve this question

asked 7 hours ago

Robert Jones

61

New contributor

Robert Jones is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

asked 7 hours ago

Robert Jones

61

asked 7 hours ago

Robert Jones

61

61

New contributor

Robert Jones is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

New contributor

Robert Jones is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

Robert Jones is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

add a comment | 

add a comment | 

1 Answer
1

active

oldest

votes

up vote
3
down vote

Short answer: your SPF record has too many DNS lookups. You have included getresponse.com in your SPF record which in turn has its own include records in its SPF record which requires additional lookups.

Per the SPF RFC

SPF implementations MUST limit the number of mechanisms and modifiers
that do DNS lookups to at most 10 per SPF check, including any lookups
caused by the use of the "include" mechanism or the "redirect"
modifier.

You can test/validate your SPF record before updating your DNS by using the following URL: https://www.kitterman.com/spf/validate.html

You can check to see how many DNS lookups your SPF record is incurring by entering your domain name at https://emailstuff.org/spf/check. In your case your SPF record is causing 13 DNS lookups which is obviously greater than 10.

If you don't need getresponse.com then I would suggest taking it out.

v=spf1 a mx include:_spf.google.com -all

I would also suggest reading up on the difference between ~, -, +, and ? in your SPF record. For a good explanation see openspf.org. Once you have the SPF validated you want to change the ~all to -all to strictly enforce SPF rules. With a ~all, other servers will still be able to send email using your domain.

share|improve this answer

edited 6 hours ago

answered 6 hours ago

Tim Liston

1164

• 
  
  
  

  
  

  
  
  
  
  
  

  
  thank you for your advice. Do I need to use -all or ~all and also do I need to use +a, +mx and ip4:104.xxx.xxx.xxx or not?? how long it will take to update it?
  – Robert Jones
  5 hours ago
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  You should use -all. You can keep the a, but the purpose of having the a is to allow all hosts with A records in your DNS to send email. In my environment we do not do this. The same goes for the mx, but you've already included _spf.google.com which will cover them. This would only really be helpful if you have another mx record in your DNS that you want to allow to send email.
  – Tim Liston
  4 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  Thank you very much for your help. Do you know how long it will take for the SPF records to be update?
  – Robert Jones
  4 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  Looks like it has already updated: mxtoolbox.com/…
  – Tim Liston
  4 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  thank you, but i cant see it have not been update on https://www.kitterman.com/spf/validate.html. Do you know why?
  – Robert Jones
  4 hours ago
  

  
  
  
  

 | 
show 2 more comments

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: false,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

Robert Jones is a new contributor. Be nice, and check out our Code of Conduct.

 

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name Email

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f933334%2ferror-spf-record-must-be-in-the-correct-format%23new-answer', 'question_page');

);

Post as a guest

Name Email

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

active

oldest

votes

active

oldest

votes

up vote
3
down vote

Short answer: your SPF record has too many DNS lookups. You have included getresponse.com in your SPF record which in turn has its own include records in its SPF record which requires additional lookups.

Per the SPF RFC

SPF implementations MUST limit the number of mechanisms and modifiers
that do DNS lookups to at most 10 per SPF check, including any lookups
caused by the use of the "include" mechanism or the "redirect"
modifier.

You can test/validate your SPF record before updating your DNS by using the following URL: https://www.kitterman.com/spf/validate.html

You can check to see how many DNS lookups your SPF record is incurring by entering your domain name at https://emailstuff.org/spf/check. In your case your SPF record is causing 13 DNS lookups which is obviously greater than 10.

If you don't need getresponse.com then I would suggest taking it out.

v=spf1 a mx include:_spf.google.com -all

I would also suggest reading up on the difference between ~, -, +, and ? in your SPF record. For a good explanation see openspf.org. Once you have the SPF validated you want to change the ~all to -all to strictly enforce SPF rules. With a ~all, other servers will still be able to send email using your domain.

share|improve this answer

edited 6 hours ago

answered 6 hours ago

Tim Liston

1164

• 
  
  
  

  
  

  
  
  
  
  
  

  
  thank you for your advice. Do I need to use -all or ~all and also do I need to use +a, +mx and ip4:104.xxx.xxx.xxx or not?? how long it will take to update it?
  – Robert Jones
  5 hours ago
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  You should use -all. You can keep the a, but the purpose of having the a is to allow all hosts with A records in your DNS to send email. In my environment we do not do this. The same goes for the mx, but you've already included _spf.google.com which will cover them. This would only really be helpful if you have another mx record in your DNS that you want to allow to send email.
  – Tim Liston
  4 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  Thank you very much for your help. Do you know how long it will take for the SPF records to be update?
  – Robert Jones
  4 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  Looks like it has already updated: mxtoolbox.com/…
  – Tim Liston
  4 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  thank you, but i cant see it have not been update on https://www.kitterman.com/spf/validate.html. Do you know why?
  – Robert Jones
  4 hours ago
  

  
  
  
  

 | 
show 2 more comments

up vote
3
down vote

Short answer: your SPF record has too many DNS lookups. You have included getresponse.com in your SPF record which in turn has its own include records in its SPF record which requires additional lookups.

Per the SPF RFC

SPF implementations MUST limit the number of mechanisms and modifiers
that do DNS lookups to at most 10 per SPF check, including any lookups
caused by the use of the "include" mechanism or the "redirect"
modifier.

You can test/validate your SPF record before updating your DNS by using the following URL: https://www.kitterman.com/spf/validate.html

You can check to see how many DNS lookups your SPF record is incurring by entering your domain name at https://emailstuff.org/spf/check. In your case your SPF record is causing 13 DNS lookups which is obviously greater than 10.

If you don't need getresponse.com then I would suggest taking it out.

v=spf1 a mx include:_spf.google.com -all

I would also suggest reading up on the difference between ~, -, +, and ? in your SPF record. For a good explanation see openspf.org. Once you have the SPF validated you want to change the ~all to -all to strictly enforce SPF rules. With a ~all, other servers will still be able to send email using your domain.

share|improve this answer

edited 6 hours ago

answered 6 hours ago

Tim Liston

1164

• 
  
  
  

  
  

  
  
  
  
  
  

  
  thank you for your advice. Do I need to use -all or ~all and also do I need to use +a, +mx and ip4:104.xxx.xxx.xxx or not?? how long it will take to update it?
  – Robert Jones
  5 hours ago
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  You should use -all. You can keep the a, but the purpose of having the a is to allow all hosts with A records in your DNS to send email. In my environment we do not do this. The same goes for the mx, but you've already included _spf.google.com which will cover them. This would only really be helpful if you have another mx record in your DNS that you want to allow to send email.
  – Tim Liston
  4 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  Thank you very much for your help. Do you know how long it will take for the SPF records to be update?
  – Robert Jones
  4 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  Looks like it has already updated: mxtoolbox.com/…
  – Tim Liston
  4 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  thank you, but i cant see it have not been update on https://www.kitterman.com/spf/validate.html. Do you know why?
  – Robert Jones
  4 hours ago
  

  
  
  
  

 | 
show 2 more comments

up vote
3
down vote

up vote
3
down vote

Short answer: your SPF record has too many DNS lookups. You have included getresponse.com in your SPF record which in turn has its own include records in its SPF record which requires additional lookups.

Per the SPF RFC

SPF implementations MUST limit the number of mechanisms and modifiers
that do DNS lookups to at most 10 per SPF check, including any lookups
caused by the use of the "include" mechanism or the "redirect"
modifier.

You can test/validate your SPF record before updating your DNS by using the following URL: https://www.kitterman.com/spf/validate.html

You can check to see how many DNS lookups your SPF record is incurring by entering your domain name at https://emailstuff.org/spf/check. In your case your SPF record is causing 13 DNS lookups which is obviously greater than 10.

If you don't need getresponse.com then I would suggest taking it out.

v=spf1 a mx include:_spf.google.com -all

I would also suggest reading up on the difference between ~, -, +, and ? in your SPF record. For a good explanation see openspf.org. Once you have the SPF validated you want to change the ~all to -all to strictly enforce SPF rules. With a ~all, other servers will still be able to send email using your domain.

share|improve this answer

edited 6 hours ago

answered 6 hours ago

Tim Liston

1164

Short answer: your SPF record has too many DNS lookups. You have included getresponse.com in your SPF record which in turn has its own include records in its SPF record which requires additional lookups.

Per the SPF RFC

SPF implementations MUST limit the number of mechanisms and modifiers
that do DNS lookups to at most 10 per SPF check, including any lookups
caused by the use of the "include" mechanism or the "redirect"
modifier.

You can test/validate your SPF record before updating your DNS by using the following URL: https://www.kitterman.com/spf/validate.html

You can check to see how many DNS lookups your SPF record is incurring by entering your domain name at https://emailstuff.org/spf/check. In your case your SPF record is causing 13 DNS lookups which is obviously greater than 10.

If you don't need getresponse.com then I would suggest taking it out.

v=spf1 a mx include:_spf.google.com -all

I would also suggest reading up on the difference between ~, -, +, and ? in your SPF record. For a good explanation see openspf.org. Once you have the SPF validated you want to change the ~all to -all to strictly enforce SPF rules. With a ~all, other servers will still be able to send email using your domain.

share|improve this answer

edited 6 hours ago

answered 6 hours ago

Tim Liston

1164

share|improve this answer

share|improve this answer

edited 6 hours ago

edited 6 hours ago

edited 6 hours ago

answered 6 hours ago

Tim Liston

1164

answered 6 hours ago

Tim Liston

1164

answered 6 hours ago

Tim Liston

1164

1164

• 
  
  
  

  
  

  
  
  
  
  
  

  
  thank you for your advice. Do I need to use -all or ~all and also do I need to use +a, +mx and ip4:104.xxx.xxx.xxx or not?? how long it will take to update it?
  – Robert Jones
  5 hours ago
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  You should use -all. You can keep the a, but the purpose of having the a is to allow all hosts with A records in your DNS to send email. In my environment we do not do this. The same goes for the mx, but you've already included _spf.google.com which will cover them. This would only really be helpful if you have another mx record in your DNS that you want to allow to send email.
  – Tim Liston
  4 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  Thank you very much for your help. Do you know how long it will take for the SPF records to be update?
  – Robert Jones
  4 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  Looks like it has already updated: mxtoolbox.com/…
  – Tim Liston
  4 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  thank you, but i cant see it have not been update on https://www.kitterman.com/spf/validate.html. Do you know why?
  – Robert Jones
  4 hours ago
  

  
  
  
  

 | 
show 2 more comments

• 
  
  
  

  
  

  
  
  
  
  
  

  
  thank you for your advice. Do I need to use -all or ~all and also do I need to use +a, +mx and ip4:104.xxx.xxx.xxx or not?? how long it will take to update it?
  – Robert Jones
  5 hours ago
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  You should use -all. You can keep the a, but the purpose of having the a is to allow all hosts with A records in your DNS to send email. In my environment we do not do this. The same goes for the mx, but you've already included _spf.google.com which will cover them. This would only really be helpful if you have another mx record in your DNS that you want to allow to send email.
  – Tim Liston
  4 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  Thank you very much for your help. Do you know how long it will take for the SPF records to be update?
  – Robert Jones
  4 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  Looks like it has already updated: mxtoolbox.com/…
  – Tim Liston
  4 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  thank you, but i cant see it have not been update on https://www.kitterman.com/spf/validate.html. Do you know why?
  – Robert Jones
  4 hours ago
  

  
  
  
  

thank you for your advice. Do I need to use -all or ~all and also do I need to use +a, +mx and ip4:104.xxx.xxx.xxx or not?? how long it will take to update it?
– Robert Jones
5 hours ago

thank you for your advice. Do I need to use -all or ~all and also do I need to use +a, +mx and ip4:104.xxx.xxx.xxx or not?? how long it will take to update it?
– Robert Jones
5 hours ago

You should use -all. You can keep the a, but the purpose of having the a is to allow all hosts with A records in your DNS to send email. In my environment we do not do this. The same goes for the mx, but you've already included _spf.google.com which will cover them. This would only really be helpful if you have another mx record in your DNS that you want to allow to send email.
– Tim Liston
4 hours ago

You should use -all. You can keep the a, but the purpose of having the a is to allow all hosts with A records in your DNS to send email. In my environment we do not do this. The same goes for the mx, but you've already included _spf.google.com which will cover them. This would only really be helpful if you have another mx record in your DNS that you want to allow to send email.
– Tim Liston
4 hours ago

Thank you very much for your help. Do you know how long it will take for the SPF records to be update?
– Robert Jones
4 hours ago

Thank you very much for your help. Do you know how long it will take for the SPF records to be update?
– Robert Jones
4 hours ago

Looks like it has already updated: mxtoolbox.com/…
– Tim Liston
4 hours ago

Looks like it has already updated: mxtoolbox.com/…
– Tim Liston
4 hours ago

thank you, but i cant see it have not been update on https://www.kitterman.com/spf/validate.html. Do you know why?
– Robert Jones
4 hours ago

thank you, but i cant see it have not been update on https://www.kitterman.com/spf/validate.html. Do you know why?
– Robert Jones
4 hours ago

 | 
show 2 more comments

Robert Jones is a new contributor. Be nice, and check out our Code of Conduct.

 

draft saved

draft discarded

Robert Jones is a new contributor. Be nice, and check out our Code of Conduct.

Robert Jones is a new contributor. Be nice, and check out our Code of Conduct.

Robert Jones is a new contributor. Be nice, and check out our Code of Conduct.

 

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name Email

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f933334%2ferror-spf-record-must-be-in-the-correct-format%23new-answer', 'question_page');

);

Post as a guest

Name Email

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name Email

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name Email

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name Email

Name Email

Name

Email

Name Email

Name

Email