What is an SPF record?
SPF (Sender Policy Framework, RFC 7208) is a DNS TXT record that lists the servers allowed to send email for your domain. When a mail server receives a message claiming to come from your domain, it looks up your SPF record and checks whether the sending server's IP is on the list. If it is not, the message can be rejected or marked as spam.
A typical SPF record looks like this:
v=spf1 ip4:203.0.113.0/24 include:_spf.google.com include:sendgrid.net ~allIt says: "my own servers in 203.0.113.0/24, Google Workspace and SendGrid may send mail for me; treat everything else as suspicious."
How to use the SPF checker
- Enter your domain (for example
example.com). URLs andwww.are cleaned up automatically. - The checker fetches your SPF record, follows every
includeandredirect, and counts the DNS lookups. - You get a grade from A to F, a list of problems in plain English, an explanation of every part of the record and the full include tree.
How to read the results
- Grade: A means no problems. Each warning lowers the grade a little, each error a lot. A missing record, multiple records or
+allalways get an F. - DNS lookups (x / 10): the number of DNS queries a receiver needs to evaluate your record, including nested includes. Above 10, SPF fails.
- Void lookups (x / 2): lookups that return nothing, such as an include for a domain without SPF. More than 2 is also a permanent error.
- What this record means: each mechanism of your record translated into a sentence.
- Include tree: every record you include and the records they include, so you can see where your lookups go.
SPF mechanisms and qualifiers
| Mechanism | Meaning | DNS lookup? |
|---|---|---|
ip4: / ip6: | An IP address or range that may send. | No |
a | The IPs in the domain's A/AAAA records. | Yes |
mx | The IPs of the domain's mail servers. | Yes |
include: | Everything the other domain's SPF record allows. | Yes (plus its own lookups) |
exists: | Match if a name exists (advanced, used with macros). | Yes |
ptr | Match by reverse DNS. Deprecated, do not use. | Yes |
redirect= | Use another domain's SPF record instead. | Yes |
all | Matches everything else. Always the last mechanism. | No |
Each mechanism can have a qualifier in front: + pass (the default), - fail,
~ soft fail and ? neutral. In practice the qualifier only matters on all.
-all vs ~all vs ?all vs +all
-all(hard fail): mail from unlisted servers should be rejected. The strictest option and the right choice for domains that send no email at all (v=spf1 -all).~all(soft fail): accept but mark as suspicious. With DMARC in place, this is safe and very common, because DMARC makes the final decision.?all(neutral): no opinion. Gives no protection. Avoid it.+all(pass): authorizes every server on the internet to send as you. It is the same as having no SPF at all, but worse, because it looks valid. Never use it.
The 10 DNS lookup limit
To protect receivers from slow or abusive records, SPF allows at most 10 DNS lookups per check.
Every include, a, mx, ptr, exists and
redirect counts, and so do the ones inside the records you include. Google Workspace alone uses 4,
Microsoft 365 about 2, and marketing and support tools add more. Exceed the limit and receivers return
permerror: SPF fails for all your mail, not just the extra senders.
How to reduce SPF lookups
- Remove services you no longer use. Old newsletters, CRMs and helpdesks are the usual suspects.
- Remove
aandmxif your web and mail servers do not actually send mail directly. - Use subdomains for bulk mail. Send newsletters from
news.example.comwith its own SPF record; it has its own 10-lookup budget. - Replace includes with ip4/ip6 ranges, but only for providers with stable, documented IP ranges, because you will have to update them yourself.
- Avoid "SPF flattening" services unless they update automatically; a stale flattened record breaks silently when the provider changes IPs.
Common SPF errors
Multiple SPF records
A domain must have exactly one TXT record starting with v=spf1. Adding a second one when you sign up for
a new service is a very common mistake, and it makes SPF fail completely. Merge them:
v=spf1 include:a.com -all and v=spf1 include:b.com -all become
v=spf1 include:a.com include:b.com -all.
No SPF record
Without SPF, receivers cannot tell your real mail from forgeries, and Gmail, Yahoo and Microsoft increasingly send unauthenticated mail to spam or reject it.
Include without a record
If you include a domain that has no SPF record (because of a typo or a provider that changed its setup), receivers treat the whole record as broken. Check the include tree for errors.
Syntax errors
Typos like ip4:192.168.1, include _spf.google.com (missing colon) or unknown words make the
record invalid. The checker lists each invalid term.
How to create or fix your SPF record
- List every service that sends email as your domain: your mailbox provider, website contact forms, newsletter tool, CRM, helpdesk, invoicing software.
- Find the SPF include each provider documents (for example
include:_spf.google.comfor Google Workspace orinclude:spf.protection.outlook.comfor Microsoft 365). - Combine them into one record that starts with
v=spf1and ends with~allor-all. - Publish it as a TXT record on the root of your domain (name
@) at your DNS provider. - Check it here and confirm the grade and the lookup count.
SPF is not enough on its own
SPF checks the hidden "envelope" sender (Return-Path), not the From address your recipients see, and it breaks when mail is forwarded. That is why you also need DKIM (a cryptographic signature) and DMARC, which ties SPF and DKIM to the visible From address and tells receivers what to do with mail that fails. Once your SPF record gets an A, check your policy with our DMARC Checker. You can see all the TXT records of your domain with the DNS Lookup.