Free Tool

SPF Record Checker

Validate your domain's SPF record. Detect syntax errors, DNS lookup limits, and missing configurations that cause email deliverability issues.

Free instant check — no signup required

What is SPF?

Sender Policy Framework (SPF) is an email authentication protocol that helps prevent email spoofing. It works by allowing domain owners to publish a DNS record that lists which mail servers are authorized to send email on behalf of their domain.

When a receiving mail server gets an email, it checks the SPF record of the sender's domain. If the sending server's IP address matches one of the authorized servers in the SPF record, the email passes SPF authentication. If not, the email may be rejected or marked as spam.

SPF is one of three key email authentication protocols (along with DKIM and DMARC) that work together to protect your domain from spoofing and improve email deliverability.

Frequently Asked Questions

What is an SPF record?
SPF (Sender Policy Framework) is a DNS TXT record that specifies which mail servers are authorized to send email on behalf of your domain. When a receiving server gets an email claiming to be from your domain, it checks your SPF record to verify the sending server is authorized.
How do I create an SPF record?
Add a TXT record to your domain's DNS with the value starting with "v=spf1". Include the IP addresses or domains of your mail servers using mechanisms like "include:", "ip4:", or "a:". End with "-all" (hard fail) or "~all" (soft fail) to specify how unauthorized senders should be handled.
What does the 10 DNS lookup limit mean?
SPF records are limited to 10 DNS lookups. Each "include:", "a:", "mx:", and "redirect=" mechanism counts as one lookup. Exceeding this limit causes SPF validation to fail with a "permerror", which can result in your emails being rejected or sent to spam.
What's the difference between ~all and -all?
"~all" (soft fail) tells receiving servers that unauthorized senders should be treated with suspicion but not outright rejected. "-all" (hard fail) tells them to reject emails from unauthorized senders. "-all" provides stronger protection but should only be used when you're confident all legitimate senders are included in your SPF record.
Why is my SPF record failing?
Common reasons include: exceeding the 10 DNS lookup limit, syntax errors in the record, missing "include:" directives for third-party email services (like Google Workspace, Microsoft 365, or SendGrid), using multiple SPF records (only one is allowed per domain), or having a record that's too long (over 255 characters in a single string).

Related Email Authentication Tools

DKIM Checker

Verify DKIM signing is configured correctly across 23 selectors.

DMARC Checker

Analyze DMARC policy and check SPF/DKIM alignment.

Email Blacklist Checker

Check your domain against 60 blacklists and get a deliverability score.

Need continuous SPF monitoring?

Get automatic alerts when your SPF record changes or breaks. Monitor SPF, DKIM, DMARC, and 60 blacklists.

Start Monitoring Free