SPF Record Look Up
Related tools
What this is
SPF (Sender Policy Framework) is a TXT record listing the servers allowed to send email for your domain. Receivers check the connecting server against the list; combined with DMARC it stops others from forging your address.
How to read your result
One record starting v=spf1, mechanisms for each legitimate sending service, and a final all qualifier — ideally ~all or -all. Watch the DNS-lookup count: include/a/mx/exists mechanisms may total at most 10.
Common problems and how to fix them
More than 10 DNS lookups (permerror)
How it shows up: SPF evaluates as permanent error at receivers; authentication fails despite the record "looking right". Common after stacking several SaaS includes.
How to fix it: Remove includes for services you no longer use, replace a/mx with explicit ip4/ip6 where practical, or use the SPF flattening tool to resolve includes to raw IPs (then re-flatten periodically, since provider ranges change).
Legitimate mail fails because a sending service is missing
How it shows up: Mail from one tool (helpdesk, newsletter, CRM) goes to spam or bounces, while other mail is fine.
How to fix it: Add that provider's documented include (or IP ranges) to the existing record. Never create a second v=spf1 record — extend the one record.
Record ends with +all or ?all
How it shows up: Anyone anywhere passes SPF for your domain — spammers included; your domain's reputation erodes.
How to fix it: Tighten the policy: ~all (softfail) while validating your sender list, then -all once you are confident every legitimate source is included.
SPF correct but forwarded mail still fails
How it shows up: Mail routed through forwarders (mailing lists, university forwards) fails SPF at the final receiver.
How to fix it: This is inherent: forwarding breaks SPF because the forwarder's IP is not in your record. Deploy DKIM (which survives forwarding) plus DMARC, so messages authenticate via DKIM even when SPF fails.
Related reading
- DNS Record Types, ExplainedA practical tour of every DNS record you will actually touch — A, AAAA, CNAME, MX, TXT, SRV, CAA, the DNSSEC set and the modern HTTPS record — with syntax, gotchas and when to reach for each.
- Reading DMARC Reports: Turn Raw XML Into a Path to p=rejectDMARC aggregate reports arrive as compressed XML nobody can read by hand. Learn how to parse them, spot spoofers, and safely move your domain to p=reject.
- BIMI Records Explained: Getting Your Logo to Show Up in the InboxHow BIMI puts your verified logo next to your emails, why it depends on strict DMARC, and how to read your BIMI DNS record and catch the usual setup mistakes.
Frequently asked questions
- What is an SPF record?
- An SPF (Sender Policy Framework) record is a DNS TXT record listing the mail servers allowed to send email for your domain. Receiving servers check it to help detect spoofing.
- How do I check my SPF record?
- Enter your domain above and run the lookup — it fetches the published v=spf1 TXT record and explains each mechanism in plain language.
- Can a domain have more than one SPF record?
- No. A domain must publish exactly one v=spf1 record; multiple SPF records make SPF fail with a PermError. Merge them into one — the SPF flattening tool can help.
- What does -all vs ~all mean?
- The trailing “all” sets the default action: -all (hard fail) tells receivers to reject unauthorized senders, while ~all (soft fail) only marks them suspicious. Use ~all while testing, then -all once you are confident.
- Why does SPF fail above 10 DNS lookups?
- SPF permits at most 10 DNS-querying mechanisms (include, a, mx, etc.). Exceeding that returns a PermError and SPF fails — flatten includes into IP addresses to stay under the limit.