SPF record

SPF Checker

Check your domain's SPF record. SPF tells receiving servers which servers are allowed to send email as your domain - a core anti-spoofing and deliverability signal.

One record is only part of it

MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DNSSEC and BIMI all decide together whether your mail is trusted. The full report reads every one of them and hands you the fix.

Run the full domain check

About these results

This tool reads your domain's public SPF (TXT) record at the moment of the check and reports what it finds with general best-practice guidance. Results reflect current public DNS and can be affected by caching and propagation (up to 24-48 hours). Recommendations are general guidance, do not guarantee deliverability, and are not a substitute for your email provider's official setup instructions. We don't store the domains you check.

Reference

How SPF works

What the record is for, how to read the result, and what to do about each problem.

What is SPF?

SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers may send email as your domain. When a message arrives, the receiver checks SPF to help decide whether it's genuine - so a correct SPF record reduces spoofing and improves deliverability.

How to read the result

OK - a valid SPF record was found with no detected issues.
Too many DNS lookups - SPF allows at most 10; over that it fails (permerror).
Missing all - no default for unlisted servers; add ~all or -all.
Soft fail (~all) - consider moving to -all once all senders are listed.

Common problems and fixes

No SPF record: publish a TXT record like v=spf1 include:_spf.yourprovider.com ~all.
Too many lookups: consolidate include mechanisms or flatten to IP ranges.
Ends without all: add ~all (testing) or -all (enforced).

Questions

Frequently asked

What is an SPF record?

SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are allowed to send email using your domain. Receivers check it to help decide whether a message is genuine or spoofed.

What does ~all vs -all mean?

The final all mechanism sets the default for servers not listed. ~all (soft fail) marks other mail as suspicious; -all (hard fail) tells receivers to reject it. Move to -all once you are sure every legitimate sender is listed.

Why does SPF have a 10 DNS lookup limit?

SPF allows at most 10 DNS lookups (from include, a, mx, ptr, exists). Exceeding it causes a permerror and SPF stops working, which can break legitimate mail. Consolidate includes to stay under the limit.

Related checks