Back to tools

Email tool

SPF Record Checker

Find and review the SPF TXT record that tells receivers which servers may send mail for a domain.

DNS query

What SPF does

SPF (Sender Policy Framework, RFC 7208) is a DNS TXT record that declares which servers may send mail using a domain in the envelope MAIL FROM (the return-path). A receiver checks the connecting IP against the record's mechanisms and returns a result — pass, fail, softfail, neutral, none, permerror, or temperror (RFC 7208 §2.6).

How to read the results

A valid record starts with v=spf1 and ends with an all mechanism. Between them, mechanisms list authorized sources: ip4/ip6 for literal addresses, a and mx for the domain's own records, and include for delegated senders. Mechanisms are evaluated left to right and the first match wins, so order matters. The qualifier on all sets the default for everything unmatched: -all hard-fails unlisted senders, ~all soft-fails them, ?all is neutral, and +all passes everyone.

A worked example

Consider "v=spf1 include:_spf.google.com ip4:198.51.100.0/24 -all". The include pulls in Google's own SPF record and counts as one of your ten DNS lookups; mail from any IP inside Google's published ranges, or inside the 198.51.100.0/24 block, passes. Everything else falls through to -all and fails. Changing the ending to ~all would instead mark unlisted senders softfail — usually still delivered but flagged, a common choice while rolling SPF out before enforcing it.

Common problems / misconfigurations

Most SPF breakage comes from a handful of recurring mistakes:

  • Two or more v=spf1 records on one domain — produces permerror; merge them into one.
  • More than ten DNS-querying mechanisms — exceeds the RFC 7208 §4.6.4 limit and causes permerror.
  • Ending in +all — authorizes any sender and defeats the record's purpose.
  • Using the deprecated ptr mechanism — slow and discouraged by RFC 7208 §5.5.

FAQ

  • Why is my SPF failing with too many DNS lookups? — SPF allows a maximum of 10 DNS lookups (RFC 7208 §4.6.4); flatten includes or use macros to stay under it.
  • Can I have two SPF records? — No. A domain must publish exactly one v=spf1 record, or evaluation returns permerror.
  • Does SPF check the From header? — No. SPF authenticates the envelope MAIL FROM, not the visible From; DMARC is what ties the two together.