Skip to main content

SPF Checker

Check your domain's published SPF record for configuration errors, included domains, DNS lookup limits, and other common SPF issues.

How to Use the SPF Checker

Checking your SPF configuration only takes a few seconds:

  1. Enter your domain name : Use the domain you want to check, such as example.com. You don’t need to enter https:// or an email address.
  2. Run the SPF check : The checker queries DNS for the SPF record published by your domain.
  3. Review the results: Check the published SPF record, detected mechanisms and included domains, DNS lookup count, and any configuration warnings reported by the checker.

If the checker reports a problem, review the affected part of your SPF record before making changes. SPF records often contain mechanisms added for third-party email services, so removing an unfamiliar entry without identifying what uses it could cause legitimate email to fail SPF authentication.

Sender Policy Framework (SPF) Authentication Flow This diagram illustrates the SPF verification process, which helps protect a domain against unauthorized email sending. When an email arrives, the receiving mail server checks the sender’s envelope domain and queries DNS for its SPF record. It then compares the sending server’s IP address with the authorized sending sources published in that record. If the IP is authorized, SPF passes; otherwise, SPF can return a failure result that may contribute to filtering or rejection by the receiving system. Sender Policy Framework (SPF) Check Flow Sender Mail Server IP: 192.0.2.1 Receiver Mail Server 4. Evaluate IP Match DNS Server for sender-domain.com PASS FAIL / SOFTFAIL 1. Send Email From: @sender-domain.com 2. DNS TXT Query “What is the SPF record for sender-domain.com?” 3. DNS Response “v=spf1 ip4:192.0.2.1 -all” 5a. IP Matches Sender is authorized 5b. IP Doesn’t Match Sender not in SPF

Understanding Your SPF Check Results

The SPF Checker examines the SPF configuration published in your domain’s DNS. Depending on the record it finds, there are several results and potential issues to look for.

SPF Record Found

An SPF record was found in DNS for the domain.

A valid SPF record begins with:

v=spf1

Finding a record does not necessarily mean the SPF configuration is correct. The policy can still contain syntax problems, unnecessary mechanisms, multiple nested include statements, or exceed SPF’s DNS lookup limit.

You should also confirm that the policy represents the services that are actually authorized to send email for your domain.

No SPF Record Found

The checker could not find an SPF record for the domain.

If the domain sends email, check the documentation provided by your email service to determine which SPF mechanisms or include values are required.

Do not copy an SPF record from another domain or blindly use a generic example. Your SPF policy should reflect the services that actually send email for your domain.

Multiple SPF Records

A domain should not publish multiple separate SPF policies beginning with v=spf1.

For example, this is incorrect:

v=spf1 include:provider-a.example -all

and a second TXT record:

v=spf1 include:provider-b.example -all

Publishing multiple SPF records can cause SPF evaluation to return a permanent error (PermError).

If both services are legitimate senders, their required mechanisms normally need to be combined into a single SPF policy, such as:

v=spf1 include:provider-a.example include:provider-b.example -all

Always follow the SPF configuration instructions provided by the services you actually use.

DNS Lookup Limit

SPF limits an evaluation to 10 DNS-querying terms.

Mechanisms such as:

include
a
mx
exists

and the redirect modifier can contribute to this limit.

An include can also reference another SPF policy containing additional DNS-querying mechanisms, so the effective lookup count can be higher than the number of include statements visible in your own record.

If SPF evaluation exceeds the permitted limit, it can return PermError.

A high lookup count is therefore worth investigating before it reaches the limit.

Included Domains

Many SPF records authorize third-party email services using the include mechanism.

For example:

v=spf1 include:_spf.example.com -all

This tells SPF evaluators to evaluate the referenced domain’s SPF policy as part of determining whether a sending source is authorized.

Seeing an unfamiliar included domain does not automatically mean there is a problem. It may belong to an email provider, marketing platform, help desk, CRM, transactional email service, or another application authorized to send mail for your organization.

Before removing an include, identify which service depends on it.

What Is an SPF Record?

SPF (Sender Policy Framework) is an email authentication standard that allows a domain owner to publish which sending sources are authorized to send email for a domain.

The SPF policy is published as a TXT record in DNS.

A simple SPF record might look like:

v=spf1 include:_spf.example.com -all

When a receiving mail server evaluates SPF, it checks the connecting server’s IP address against the SPF policy associated with the relevant SMTP envelope identity.

If the sending source is authorized by the policy, SPF can pass. If it is not authorized, SPF returns another result according to the mechanisms and qualifiers in the policy.

SPF does not directly authenticate the visible From: address that users see in their email client. DMARC adds domain alignment so SPF and DKIM authentication can be connected to the visible sender domain.

Common SPF Mechanisms Explained

An SPF record consists of mechanisms and qualifiers that describe which sending sources are authorized.

v=spf1

Every SPF policy starts with:

v=spf1

This identifies the TXT record as an SPF version 1 policy.

include

The include mechanism evaluates another domain’s SPF policy.

For example:

include:_spf.example.com

Email providers commonly use this mechanism so customers can authorize the provider’s sending infrastructure without maintaining lists of IP addresses themselves.

Each include can contribute to SPF’s DNS lookup limit, including DNS-querying mechanisms contained within the referenced policy.

ip4

The ip4 mechanism authorizes an IPv4 address or network.

For example:

ip4:192.0.2.10

or:

ip4:192.0.2.0/24

These mechanisms are useful when you operate known outbound mail servers with stable IP addresses.

ip6

The ip6 mechanism performs the equivalent function for IPv6 addresses or networks.

For example:

ip6:2001:db8::/32

a

The a mechanism can authorize IP addresses associated with a domain’s A or AAAA records.

Because it requires DNS resolution during SPF evaluation, it contributes to the DNS lookup limit.

mx

The mx mechanism can authorize IP addresses associated with the domain’s MX records.

It also requires DNS queries and contributes to SPF’s lookup limit.

-all

The -all mechanism produces an SPF Fail result when the sending source has not matched an earlier mechanism in the policy.

For example:

v=spf1 include:_spf.example.com -all

This does not itself guarantee that the receiving mail server will reject the message. The receiving system decides how SPF results contribute to its authentication and filtering decisions.

~all

The ~all mechanism produces an SPF SoftFail result for sending sources that have not matched an earlier mechanism.

For example:

v=spf1 include:_spf.example.com ~all

SoftFail is distinct from the explicit Fail result produced by -all. Receiving mail systems determine how they use the result.

Common SPF Problems

More Than One SPF Record

Publishing multiple v=spf1 records does not create a combined SPF policy.

If several services need authorization, their required mechanisms generally need to be incorporated into a single SPF record.

Too Many DNS Lookups

SPF permits a maximum of 10 DNS-querying terms during an evaluation.

Complex policies containing multiple includeamxexists, or redirect terms can exceed this limit, particularly when included policies reference additional policies of their own.

If the limit is exceeded, SPF evaluation can return PermError.

Missing Legitimate Sending Services

An SPF policy is only useful if it accurately represents your legitimate sending infrastructure.

Organizations often send email through more systems than expected, including:

  • Primary email providers
  • Marketing platforms
  • CRM systems
  • Help-desk software
  • Transactional email services
  • Website applications
  • Monitoring systems
  • Billing and invoicing platforms

Before tightening an SPF policy or removing mechanisms, identify all services that legitimately send email for the domain.

Obsolete SPF Includes

SPF policies can accumulate entries for services that are no longer used.

An obsolete include unnecessarily authorizes infrastructure and can also increase the complexity and DNS lookup count of the SPF policy.

Periodically review your SPF configuration and remove entries only after confirming that the associated service is no longer sending legitimate email.

FAQ

Frequently Asked Questions

No. A domain should have a single SPF policy.

Publishing multiple TXT records beginning with v=spf1 can cause SPF evaluation to return PermError.

If multiple email services need to send mail for the domain, their required SPF mechanisms normally need to be combined into one policy.

SPF restricts the number of DNS-querying terms that can be used during an evaluation to 10.

Mechanisms including includeamx, and exists, along with the redirect modifier, can contribute to the limit.
The important detail is that nested policies count too. An include might lead to another SPF record that performs several additional DNS queries.

As a result, simply counting the number of include statements visible in your SPF record does not necessarily reveal the complete lookup cost.

If an SPF evaluation exceeds the permitted DNS lookup limit, it can return a permanent error (PermError).

This can prevent SPF from successfully authenticating legitimate email, so configurations approaching or exceeding the limit should be reviewed.

Both normally appear at the end of an SPF policy and determine the result for sending sources that did not match an earlier mechanism.

-all produces an SPF Fail result.

v=spf1 include:_spf.example.com -all

~all produces an SPF SoftFail result.

v=spf1 include:_spf.example.com ~all

Neither qualifier directly determines whether an email reaches the inbox, spam folder, or is rejected. Receiving systems decide how SPF results contribute to their overall authentication and filtering decisions.

SPF helps prevent unauthorized systems from successfully authenticating as permitted senders for a domain, but SPF alone does not fully protect the visible From: address against spoofing.

For stronger domain protection, SPF is normally deployed alongside DKIM and DMARC. DMARC checks whether SPF or DKIM authentication aligns with the domain shown in the visible From: address and allows the domain owner to publish a handling policy for messages that fail DMARC.

No. This checker analyzes the SPF policy published in your domain's DNS.

Whether a particular email passes SPF depends on factors including the sending server's IP address and the SMTP envelope identity used for that message.

To verify an actual email, send a test message through the relevant sending service and inspect its authentication results or message headers.

Check your SPF configuration whenever you add, remove, or change a service that sends email for your domain.

It is also worth reviewing SPF periodically because third-party services, legacy applications, and obsolete authorization mechanisms can accumulate as an organization's email infrastructure changes.

A correctly configured SPF policy is an important part of protecting your sending domain, but SPF works best alongside DKIM and DMARC.

DKIM adds cryptographic authentication to outgoing messages, while DMARC checks alignment with the domain visible to recipients and provides monitoring and policy controls
.
If you're configuring email authentication for a domain, read our How to Set Up SPF, DKIM, and DMARC for Email Authentication guide for the complete deployment process.

Monitor. Be alerted. Sleep easy.

Try UptimeObserver now. Setup in 2 minutes.