SPF Record Checker
Validate SPF records and prevent email spoofing
This page provides original, human-reviewed information about SPF record validation, covering include chains, the 10 DNS lookup limit, ip4/ip6 mechanisms, and why SPF alone is not enough without DKIM and DMARC.
SPF (Sender Policy Framework) is an email authentication method that helps prevent email spoofing by allowing domain owners to specify which mail servers are authorized to send email on behalf of their domain.
How SPF Works:
- You publish an SPF record in your domain's DNS as a TXT record
- When someone receives an email claiming to be from your domain, their mail server checks your SPF record
- The receiving server compares the sending server's IP against your authorized list
- Based on the match, the email is accepted, rejected, or marked as suspicious
SPF Record Components:
- Version: Always starts with "v=spf1"
- Mechanisms: Define which sources are authorized (ip4, ip6, include, a, mx, etc.)
- Qualifiers: Specify the action to take (+pass, -fail, ~softfail, ?neutral)
- All mechanism: Defines the default policy for unlisted sources
Benefits of SPF:
- Reduces email spoofing and phishing attacks
- Improves email deliverability and sender reputation
- Helps prevent your domain from being used in spam campaigns
- Required for DMARC implementation
Best Practices:
- Keep the SPF record under the 10-lookup limit by flattening includes.
- End the record with -all for strict enforcement (or ~all to start).
- Review the record whenever you change email providers.
Basic SPF Record Structure:
Common SPF Examples:
Basic SPF (own mail server)
Only servers listed in MX records can send email
Google Workspace
Include Google's SPF record for Gmail/Workspace
Microsoft 365
Include Microsoft's SPF record for Office 365
Multiple Services
Combine multiple email services and specific IP addresses
Too Many DNS Lookups
SPF records that require more than 10 DNS lookups will fail validation.
Solution: Reduce includes, use IP addresses instead of hostnames where possible.
Multiple SPF Records
Having multiple SPF records in DNS will cause SPF to fail.
Solution: Combine all SPF mechanisms into a single TXT record.
Missing "all" Mechanism
SPF records without an "all" mechanism may not work as expected.
Solution: Always end with ~all, -all, or ?all depending on your policy.
Syntax Errors
Invalid syntax in SPF records can cause authentication failures.
Solution: Validate SPF syntax and test thoroughly before deployment.
SPF Qualifiers Explained:
Explicitly allow the source
Reject the email
Mark as suspicious but accept
No policy specified
What's the difference between ~all and -all?
~all (soft fail) marks unauthorized emails as suspicious but still delivers them, while -all (hard fail) instructs receiving servers to reject unauthorized emails completely. ~all is recommended for most domains.
Can I have multiple SPF records?
No, you can only have one SPF record per domain. Multiple SPF records will cause SPF authentication to fail. Combine all your email sources into a single SPF record.
How long does SPF propagation take?
SPF records propagate like any DNS change, typically within 24-48 hours globally. However, many servers will see the changes within minutes to hours.
What happens if I exceed 10 DNS lookups?
SPF authentication will fail if your record requires more than 10 DNS lookups. This includes lookups from included SPF records. Monitor your lookup count and optimize when necessary.
Should I use ip4 or include mechanisms?
Use ip4/ip6 for static IP addresses you control, and include for third-party services like Google Workspace or Mailgun. Include mechanisms are more flexible but count toward the 10-lookup limit.
Do subdomains inherit SPF records?
No, subdomains do not inherit SPF records from their parent domain. Each subdomain that sends email needs its own SPF record, or you can use a wildcard SPF record.
What does SPF stand for?
Sender Policy Framework - a standard that helps prevent email spoofing by declaring which servers may send mail for a domain.
Is SPF enough to protect my domain?
No. SPF works with DKIM and DMARC to fully authenticate email. DMARC tells receivers what to do when checks fail.
How do I check my SPF record?
Enter your domain in this tool - it will look up and validate the SPF record for you.
Related Tools
Need Help?
Our tools are designed to be intuitive, but if you need assistance, we're here to help.
About Our Tools
Professional-grade email and DNS diagnostic tools trusted by IT professionals worldwide.