Hosted SPF
Add and remove SPF senders from your dashboard.
Point your SPF record at us and we serve it for you. We write out every sender's current addresses as plain ranges and refresh them every hour. Your record spends one DNS lookup on us. You add or remove a sender on the domain's page.
- Imports the record you publish today
- Refreshed every hour
- Leave with your record written out
See the senders in your SPF record
Add or remove a sender from the list. Check its recent mail volume and the DNS lookups your hosted record uses.
View full screenshot View full screenshot
Check each sender's traffic
Each row shows the mail that matched the sender's addresses in your last 30 days of reports.
Watch the lookup count
The meter counts the lookups your served record costs against SPF's limit of 10.
Point your SPF record at us
Most SPF records are a list of includes, one per provider, each spending lookups against the limit of 10. Past 10, receivers read the record as broken.
-
STEP 1
Switch to hosted SPF
On the domain's SPF page, press Switch to hosted SPF. We read the record you publish and import it sender by sender. A record we can't keep whole is refused, with the reason.
-
STEP 2
Publish our include
Replace the includes in your apex record with the one we give you. Your own ending stays:
~allor-allis still your call. -
STEP 3
Manage senders on the page
Pick a provider from the catalogue or type any mechanism. The served record carries the change within the minute.
We refresh sender addresses every hour
Providers change their addresses. We resolve them every hour and keep a history of each change.
One lookup for the include
Behind the include we publish literal ip4 and
ip6 terms. A receiver spends one lookup on your include and reads
plain addresses behind it. A list too long for one record chains a second one, and
the meter on the page counts every lookup the served record costs.
Refreshed every hour
We re-resolve every sender's published ranges each hour and publish what we find. An edit to the list applies straight away.
How much mail each sender actually sends
For each sender, see how much mail matched its addresses over the last 30 days and whether that mail passed SPF. A sender that sent nothing in 30 days shows up as exactly that.
Every change is in the digest
The Monday digest lists every change to the served record. A switch on the account page adds a same-day mail for each refresh that changed the addresses.
A big drop in addresses waits for your OK
A scheduled refresh that would drop a large share of the served addresses is held, because that shape is usually a provider's DNS answering incompletely. We email you the day it happens. One press of Refresh senders applies it when the shrink is real.
You keep your own ending
The include is one term in a record you still own. The
~all or -all you publish tells receivers what to do with
mail from an address outside the list.
What happens when a refresh fails
A refresh that fails publishes nothing
We keep serving the last good ranges and your mail keeps flowing. After a day of failed refreshes, we email you and show the failure on the page.
If our DNS is unreachable
Receivers defer your mail with a temporary error and retry. Mail bounces only if the outage holds for longer than their retries. If your plan lapses, the record keeps serving and its addresses keep refreshing. Only the sender controls lock.
Stop hosting and we write the record out for you
Press Stop hosting and the page writes a self-managed record built from your
sender list, ready to publish at your apex. It ends in ~all. Swap in
-all if that is what your record ended with. We keep answering
the include until your published record stops referencing us, and for 20 days after
that, so every sender keeps its pass across both edits.
Plans
Part of the Business plan and up
Hosted SPF includes the Monday digest, same-day alerts and sender evidence. Try every feature of the Business plan for 30 days, no card.
Business
$49 /month
10 domains
Portfolio
$79 /month
25 domains
Works alongside
Where to go next
FAQ
Questions people ask first
Is this SPF flattening?
Yes, done on a schedule and served from our zone, so the flattened record never goes stale in your DNS. You keep a list of senders. We keep their addresses current.
What happens to the ten-lookup limit?
Your record spends one lookup on our include. Behind it the addresses are literal, so reading them costs nothing. A list too long for one record chains a second one behind the first, and the meter on the page counts every lookup the served record costs.
What if a provider changes its addresses?
We re-resolve every sender each hour and publish the new ranges. The Monday digest lists the change. A same-day mail does too, if you've switched that on for the account.
Does hosted SPF need hosted DMARC?
No. Each hosted service is its own switch on the domain's page. A domain can host SPF alone and keep its DMARC record wherever it lives today.
What happens if DomainCanary is down?
Receivers that can't resolve the include defer your mail with a temporary error and retry. Mail bounces only if the outage holds for longer than their retries.
Can I keep other mechanisms in my own record?
Yes. The include is one term in a record you still own. Keep an ip4 for the office mail server beside it if you like, and keep your own ending. The meter on the page counts what we serve. Anything you keep beside the include in your own record adds to it.
How do I leave?
Press Stop hosting and the page writes out a record built from your sender list, ready to publish at your apex. We keep answering the include until your record stops referencing us, and for twenty days after that.
What does it cost?
It's part of the Business plan and up. The Business plan is $49 a month for 10 domains and the Portfolio plan is $79 for 25. Try every feature of the Business plan free for 30 days, no card needed.
Add the next sender from a page
Enabling imports the record you publish today, sender by sender. From then on the list lives on the domain's page and the addresses behind it refresh on their own.
First domain free · 30 days on the Business plan · No card
- You keep your own ending on the record; the rest points at us
- Every sender's addresses re-resolved each hour
- Last good ranges stay live. We email you after a day of failed refreshes
- Per-sender traffic from your own DMARC reports