SPF Checker

What is an SPF record?

SPF, short for Sender Policy Framework, is a line of text in your domain's DNS that lists which servers are allowed to send email for your domain. Your mailbox provider, your newsletter tool, your app: each one that sends as @yourcompany.com has to be on that list.

When an email arrives, the receiving server reads your SPF record and checks whether the server that sent it is on the list. If it is not, the email looks like a forgery, and it is far more likely to end up in spam.

A typical SPF record looks like this: v=spf1 include:_spf.google.com include:sendgrid.net ~all. The checker above takes yours apart line by line and tells you what each part does.

How to read your SPF record

Every SPF record is a list of rules, read from left to right.

• `v=spf1` opens every SPF record. Without it, the record is ignored.
• `include:` allows the servers of another service, like include:_spf.google.com for Google Workspace. This is how most email tools are added.
• `ip4:` and `ip6:` allow a specific server address or range, for servers you run yourself.
• `a` and `mx` allow the servers your domain already points to, for the website and for incoming mail.
• `~all` or `-all` closes the record and says what to do with everyone else: mark it as suspicious (~all) or reject it (-all). Never +all, which allows the whole internet.

The SPF 10 DNS lookup limit

This is the error that breaks the most SPF records, usually without anyone noticing. To check an email, a receiving server may follow at most 10 DNS lookups. Every include:, a, mx, exists and redirect counts as one, and so do the includes inside each include.

Add a few email tools and you pass 10 fast. Past the limit, receivers return an error called permerror, and SPF fails for every email you send, even from services that are listed.

The checker counts every lookup for you, nested ones included. If you are over, remove the services you no longer use, or replace an include: with the ip4: ranges it stands for when they rarely change.

Common SPF errors and how to fix them

Most SPF problems come down to one of these.

• Two SPF records. A domain may only have one. When you add a service, edit the existing record to add its include:; do not create a second record. Two records make SPF fail entirely.
• Missing `all` at the end. Without it, the record says nothing about servers that are not listed. End it with ~all.
• `+all` or `?all`. The first allows anyone to send as you; the second protects nothing. Use ~all or -all.
• A typo in an include. An include that points to a domain without an SPF record is an error for receivers. Copy includes exactly as your provider gives them.
• The `ptr` mechanism. It is deprecated, slow, and some receivers ignore it. Replace it with ip4: ranges or the include your provider offers.

SPF is one of three records

SPF on its own is not enough. Gmail and Yahoo ask senders to have SPF, DKIM and DMARC in place, and DMARC only passes when SPF or DKIM matches the domain in your From address.

Check the other two with our free DKIM Checker and DMARC Checker, or all three at once with the Deliverability Setup Checker.