Free tool
SPF Record Checker
Check any domain's SPF record in seconds. We count every DNS lookup against the 10-lookup limit, flag syntax problems, and test DKIM, DMARC and MX at the same time.
Checks SPF, DKIM, DMARC and MX records live. Free, no sign-up.
Basics
What is an SPF record?
SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send email for your domain. Receiving mail servers look it up on every message.
Step 1
You send an email
Your mailbox provider's server connects to the recipient.
Step 2
Receiver looks up SPF
It fetches the TXT record that starts with v=spf1 on your domain.
Step 3
IP is compared
The sending IP is matched against your includes, ip4, a and mx entries.
Step 4
Pass or fail
A match passes. No match falls through to your ~all or -all rule.
Step 5
DMARC decides
The result feeds DMARC, which decides between inbox, spam and reject.
- DNS lookups allowed per SPF check
- 10
- SPF record allowed per domain
- 1
- characters per TXT string (longer records are split)
- 255
- daily emails to Gmail that make SPF + DKIM + DMARC mandatory
- 5,000+
Syntax
SPF record syntax, mechanism by mechanism
An SPF record is read left to right. The first mechanism that matches the sending IP decides the result.
| Mechanism | Example | What it does | Costs a lookup? |
|---|---|---|---|
| v=spf1 | v=spf1 | Version tag. Must come first. | No |
| include | include:_spf.google.com | Authorizes everything another domain's SPF authorizes. | Yes, plus its nested lookups |
| a | a | Authorizes the IPs in your domain's A record. | Yes |
| mx | mx | Authorizes the servers in your MX records. | Yes |
| ip4 / ip6 | ip4:203.0.113.10 | Authorizes a single IP or range. | No |
| exists | exists:%{i}.spf.example.com | Advanced macro-based check. | Yes |
| redirect | redirect=_spf.example.com | Uses another domain's SPF record instead. | Yes |
| ptr | ptr | Reverse-DNS match. Deprecated; avoid it. | Yes |
| all | ~all | Catch-all for every sender not matched above. | No |
Qualifiers
Each mechanism can be prefixed with a qualifier: + pass (the default), - fail, ~ soft fail and ? neutral. In practice you only set a qualifier on all. Never publish +all: it lets every server on the internet send as your domain.
Copy & paste
SPF records for Google Workspace and Microsoft 365
Use the record for the provider that hosts your mailboxes. Outreach tools that connect to your Google or Microsoft mailbox send through that provider, so they don't need their own include.
Google Workspace
v=spf1 include:_spf.google.com ~allMicrosoft 365
v=spf1 include:spf.protection.outlook.com -allGoogle Workspace + a transactional provider (example: SendGrid)
v=spf1 include:_spf.google.com include:sendgrid.net ~allAdding a second sender? Edit the record, don't add another one.
Troubleshooting
Common SPF errors and how to fix them
| What the checker says | What it means | How to fix it |
|---|---|---|
| No SPF record found | Receivers can't verify your senders, and Gmail and Yahoo may reject or junk your mail. | Publish one TXT record at your root domain using the template for your provider. |
| Multiple SPF records | SPF returns permerror, which counts as a failure. | Merge all includes into one v=spf1 record and delete the rest. |
| Over 10 DNS lookups | SPF returns permerror even for allowed servers. | Remove unused includes, replace a/mx with ip4 where the IPs are stable, or move bulk tools to a subdomain. |
| Ends in +all or ?all | Anyone can send as your domain. | End the record with ~all or -all. |
| No 'all' mechanism | Unmatched senders get a neutral result. | Add ~all at the end of the record. |
SPF is only one of the three records receivers check. Run your domain through the DMARC checker next, or read the full email deliverability guide.
The full picture
SPF vs DKIM vs DMARC
| Record | What it proves | Where it lives | Required for bulk senders? |
|---|---|---|---|
| SPF | The sending server is allowed to send for the domain. | yourdomain.com TXT | Yes (Gmail, Yahoo, Outlook.com) |
| DKIM | The message was signed by the domain and not altered. | selector._domainkey TXT | Yes (Gmail, Yahoo, Outlook.com) |
| DMARC | SPF or DKIM aligns with the visible From domain, plus the policy for failures. | _dmarc TXT | Yes, p=none at minimum |
Don't want to touch DNS at all?
Get your DNS fix list
Tell us where to send it. We'll reply with mailbox, domain and DNS recommendations for your sending volume — or start right away and have mailboxes live in minutes.
Where should we send it?
Or see pricing →Frequently asked questions
How do I check my SPF record?
Enter your domain in the checker above. It reads your live TXT records, validates the SPF syntax and counts every DNS lookup. From a terminal you can also run "dig TXT yourdomain.com +short" or "nslookup -type=txt yourdomain.com" and look for the line starting with v=spf1.
Can a domain have two SPF records?
No. A domain must publish exactly one TXT record that starts with v=spf1. Two records make SPF return a permanent error (permerror), which counts as a failure. Merge all your includes into a single record.
What is the SPF 10 DNS lookup limit?
RFC 7208 limits SPF evaluation to 10 DNS lookups. Every include, a, mx, ptr, exists and redirect counts, including the ones nested inside the records you include. Go over 10 and SPF fails with a permerror, even if the sending server is allowed.
Should I use ~all or -all?
~all (soft fail) marks unlisted senders as suspicious; -all (hard fail) tells receivers to reject them. Once DMARC is in place, DMARC decides what happens to failing mail, so ~all is a safe default. Use -all when you are sure every legitimate sender is listed.
How long does an SPF change take to work?
As long as your DNS record's TTL. Most providers use a TTL between a few minutes and one hour, so changes usually show up quickly, but some resolvers can cache old values for up to 48 hours.
Does SPF alone stop people spoofing my domain?
No. SPF checks the envelope sender (Return-Path), not the From address people see. DMARC is what ties SPF and DKIM results to the visible From domain and tells receivers to block spoofed mail.