Free SPF Record Checker & Validator
| Domain | Type | Record |
|---|
Verify domain email authentication, check v=spf1 syntax, trace included mechanisms, and monitor the 10 DNS lookup limit.
SPF (Sender Policy Framework) Overview
What is an SPF record?
An SPF (Sender Policy Framework) record is a DNS record that helps protect your domain from email spoofing. It tells receiving mail servers which servers are authorized to send emails on behalf of your domain. When an email arrives, the receiving server compares the sender's IP address with your SPF policy to verify whether the message came from an approved source.
Why is an SPF record important?
If your domain doesn't have an SPF record, malicious actors can forge your email address and send fraudulent messages that appear to come from you. By publishing an SPF record, you make it easier for mail providers to identify legitimate emails, improving your domain's reputation and increasing the likelihood that your messages reach recipients' inboxes instead of being filtered as spam.
What does an SPF record contain?
An SPF record is stored as a TXT record in your domain's DNS zone. It begins with v=spf1, followed by one or more mechanisms that define which mail servers are allowed to send email for the domain. These may include specific IP addresses, your domain's mail servers, or trusted third-party email providers. The record ends with a policy such as -all or ~all, which tells receiving mail servers how to handle messages sent from unauthorized sources.
Example
example.com. 3600 IN TXT "v=spf1 ip4:192.0.2.0/24 -all"
How do you create an SPF record?
Start by identifying every service that sends email using your domain, such as your mail server, Microsoft 365, Google Workspace, or a marketing platform. Publish a single SPF record as a TXT record at your domain's root, beginning with v=spf1. Add each authorized sender using mechanisms like ip4:, ip6:, include:, a, or mx, then finish the record with either -all to reject unauthorized senders or ~all to mark them as suspicious. As your email infrastructure changes, remember to keep the record updated and ensure it stays within SPF's limit of 10 DNS lookups.
FAQs
SPF Troubleshooting & Practical Fixes
The SPF standard (RFC 7208) limits resolvers to 10 DNS queries when inspecting SPF policies. Every include:, a, mx, ptr, and exists: tag triggers a DNS lookup. Nested includes (services that include other services) rapidly exceed the limit, causing receiving mail servers to reject messages with a permanent failure.
include: or a tags with direct ip4: or ip6: CIDR subnets where possible, because IP mechanisms require zero DNS queries.
When setting up a new service (like Google Workspace, Zendesk, or Mailgun), administrators often add a brand new TXT record instead of editing the existing one. When a receiving server detects two records starting with v=spf1, SPF automatically fails with PermError.
v=spf1 include:_spf.google.com include:mailgun.org ~all. Delete all other TXT records starting with v=spf1.
If an email server or third-party web application sends mail using your domain but its IP is omitted from your SPF record, receiving servers flag the message with a soft failure.
Received: from line, and append it to your SPF string as ip4:xxx.xxx.xxx.xxx or add the provider's official include mechanism before the closing ~all.