SPF Record Checker
Look up and validate any domain's SPF record — check mechanisms, lookup count, and get actionable recommendations.
How SPF Works Under the Hood
SPF (RFC 7208) is a published allowlist of the servers permitted to send mail for your domain, expressed as a single DNS TXT record. The record starts with v=spf1 and chains together mechanisms evaluated left to right: ip4: and ip6: authorise addresses directly, include: delegates to another domain's record (how you authorise Google, Microsoft, or SendGrid), and mx authorises your inbound mail hosts. The terminal ~all (softfail) or -all (hardfail) declares what receivers should do with everything unlisted.
The constraint that trips up most real-world records is the 10-DNS-lookup limit. Every include, a, mx, ptr, exists, and redirect consumes a lookup — recursively, through every nested include inside your providers' records — and blowing past ten yields a permerror that many receivers, and DMARC, treat as a failure. Domains that accumulate SaaS senders over the years hit this ceiling quietly. The fix is pruning unused includes or flattening: replacing include chains with the underlying ip4/ip6 ranges, which costs zero lookups but must be refreshed when providers change their netblocks.
It also matters to understand what SPF does not do. SPF validates the envelope sender (Return-Path) used during the SMTP transaction — not the From header your users actually see in their mail client. An attacker can pass SPF cleanly with their own domain in the envelope while displaying yours in the From line. Closing that hole is DMARC's job: it requires the SPF-validated domain (or a DKIM signature's domain) to align with the visible From domain. SPF is a necessary foundation, but it only becomes an anti-spoofing control once DMARC sits on top of it.
SPF Concepts Worth Knowing
Mechanismsip4/ip6 authorise addresses directly, include delegates to a provider, a and mx reference your own DNS, and all catches everything else. Evaluation stops at the first match.
QualifiersA prefix on any mechanism: + pass (default), ~ softfail, - fail, ? neutral. In practice they matter most on the trailing all, which sets your policy for unlisted senders.
10-lookup limitinclude, a, mx, ptr, exists, and redirect each cost one DNS lookup, counted recursively. Eleven or more yields permerror — effectively an SPF failure under DMARC.
Multiple-record errorA domain must publish exactly one SPF record. Two TXT records starting with v=spf1 is a permerror — merge their mechanisms into a single record instead.
Common includesinclude:_spf.google.com for Google Workspace, include:spf.protection.outlook.com for Microsoft 365. Each provider documents its own; never guess these values.
Upgrade path to DMARCSPF checks the envelope sender only. Add DKIM signing, then a DMARC record with alignment, to protect the From header users actually see — starting at p=none to monitor.