SPF checker

What SPF is

SPF (Sender Policy Framework) is a single DNS TXT record on your domain that lists the servers allowed to send email for it. When a message arrives, the receiving server looks at the domain in the envelope sender (the Return-Path, also called MAIL FROM), fetches that domain's SPF record, and checks whether the connecting IP address is on the list.

The result is pass, fail, softfail, neutral, none (no record) or an error. Gmail, Yahoo and Outlook use it as one input when deciding between inbox, spam folder and rejection. SPF on its own does not protect the visible From address, which is why it is paired with DKIM and DMARC.

example.com.  IN  TXT  "v=spf1 include:_spf.google.com include:amazonses.com ~all"

How to read the result

A record is read left to right. Each part is a mechanism that either matches the sending IP or does not. The first match decides the result, and the final all catches everything else.

• ip4: and ip6: match a literal address or range. They cost no DNS lookups.
• include: pulls in another domain's SPF record, which is how you authorise a provider such as Google or SendGrid. Each one costs a lookup, plus whatever lookups are inside the included record.
• a and mx match the IPs behind your A or MX records. Each costs a lookup.
• ~all (softfail) says anything not listed is probably not you. -all (fail) says it is definitely not you. ?all says nothing, and +all says everyone is allowed.

Our scan resolves every include and redirect the way a receiving server would, then reports the total lookup count, the senders it found, and which problems need attention first.

The 10-lookup limit

SPF allows at most 10 DNS lookups while evaluating a record. The mechanisms include, a, mx, ptr, exists and the redirect modifier each count, including any nested inside included records. ip4, ip6 and all do not. Go over 10 and receivers return a permanent error (permerror), which is treated as an SPF failure. The record looks fine in a text editor and still breaks, because each provider's include hides several lookups of its own.

The specification also recommends stopping after two "void" lookups, which are lookups that return nothing. A stale include pointing at a domain that no longer publishes SPF can trigger it.

To get back under the limit, remove services you no longer use, replace a and mx with literal ip4: ranges where the addresses are stable, and move marketing mail to a subdomain with its own SPF record.

Common SPF mistakes

Two SPF records on one domain. Receivers must treat this as an error, so the usual cause is adding a second TXT record when you sign up to a new service. Merge them into one:

example.com.  IN  TXT  "v=spf1 include:_spf.google.com ~all"
example.com.  IN  TXT  "v=spf1 include:sendgrid.net ~all"

example.com.  IN  TXT  "v=spf1 include:_spf.google.com include:sendgrid.net ~all"

Ending with +all, or ?all. +all authorises the whole internet to send as you, so it is worse than having no record. Use ~all or -all.

Missing all entirely. Without it the record never says what to do with unlisted senders.

Using ptr. It is slow, unreliable and discouraged by the SPF specification. Replace it with ip4: or include:.

Forgetting a sender. Newsletter tools, CRMs, invoicing apps and support desks often send as your domain. If one is missing from the record, its mail can fail SPF.

Expecting SPF to survive forwarding. A forwarded message arrives from the forwarder's IP, which is not in your record. That is expected, and one reason DKIM matters.

How to fix your SPF record

1. List every service that sends email as your domain: your mailbox provider, your marketing tool, your website or app, your helpdesk.
2. Find each provider's SPF include in its documentation. Common ones are include:_spf.google.com (Google Workspace), include:spf.protection.outlook.com (Microsoft 365), include:sendgrid.net (SendGrid) and include:amazonses.com (Amazon SES).
3. Combine them into one TXT record at the root of the domain, ending in ~all (or -all once you are confident the list is complete).
4. Publish it, wait for DNS to update, and scan again to confirm the lookup count is 10 or fewer.

A domain that never sends email should say so, which stops others from forging it:

example.com.  IN  TXT  "v=spf1 -all"

SPF passing is also not quite enough for DMARC: the domain that passed SPF has to match the visible From domain. See the DMARC checker for how alignment works.