SPF Checker

What is an SPF record?

Reviewed by Prabath Thalangama · Last updated October 22, 2026

An SPF (Sender Policy Framework) record is a DNS TXT record starting with v=spf1 that lists the servers allowed to send email for your domain. Receiving mail servers compare the sending IP against it. This checker fetches the record, parses every mechanism, counts its DNS lookups and flags the mistakes that make SPF fail.

SPF is checked against the envelope sender (the MAIL FROM or Return-Path address), not the From address people see. That is why SPF alone does not stop spoofing: DMARC is what ties the result to the visible From domain.

The most common SPF failure is not a missing record but a broken one: two v=spf1 records, or a record that needs more than the 10 DNS lookups RFC 7208 allows. Either one produces a permerror, and many receivers then treat the domain as having no SPF at all.

How do I check my SPF record?

Enter the domain you send mail from, for example example.com. Use the domain, not an email address.
Read the record and the mechanism list, then check the DNS lookup count and any findings.
Fix the record at your DNS provider, wait for the old TTL to expire, and run the check again.

How to read the results

Record: The v=spf1 TXT record published at the domain. If more than one exists, all of them are a problem, not just the first.
Mechanisms: Each term of the record with its qualifier: + pass (the default), - fail, ~ softfail and ? neutral. ip4/ip6 match addresses directly; include, a, mx, exists, ptr and redirect need DNS lookups.
DNS lookups: How many lookup-consuming mechanisms the record itself contains. Every include: points at another SPF record whose own includes, a and mx terms also count, so the real total can be higher than this number. Check each included record when you are near the limit.
Findings: Problems ranked by severity: critical (SPF will fail), warning (weakens protection) or info.

Common SPF errors and how to fix them

SPF permerror: too many DNS lookups

RFC 7208 allows at most 10 lookups while evaluating SPF, including the ones inside every include. Remove includes for services you no longer use, replace your own servers' a and mx terms with ip4/ip6 ranges (which cost nothing), and never use ptr. Some providers offer a narrower include for one product instead of their whole platform.

# Before: 4 includes, each pulling in more lookups
v=spf1 a mx include:_spf.google.com include:spf.protection.outlook.com include:sendgrid.net include:mailgun.org ~all

# After: own servers as IPs, unused provider removed
v=spf1 ip4:203.0.113.10 include:_spf.google.com include:sendgrid.net ~all

Multiple SPF records

A domain may publish only one v=spf1 record. Adding a second record for a new email service, instead of editing the first, is the usual cause. Merge both into one record.

# Wrong: two records
"v=spf1 include:_spf.google.com ~all"
"v=spf1 include:sendgrid.net ~all"

# Right: one merged record
"v=spf1 include:_spf.google.com include:sendgrid.net ~all"

+all, or no all at the end

+all tells receivers that any server on the internet may send as you, which defeats SPF entirely. A record with no all mechanism ends in a neutral result. End the record with ~all or -all.

~all or -all?

-all (fail) asks receivers to reject mail from unlisted servers; ~all (softfail) asks them to accept but mark it. Start with ~all while you find every service that sends as your domain. Once DMARC is enforcing, receivers act mainly on the DMARC result, so ~all is a sound long-term choice for most domains.

Examples and command-line equivalents

Google Workspace only

v=spf1 include:_spf.google.com ~all

Microsoft 365 plus your own server

v=spf1 ip4:203.0.113.10 include:spf.protection.outlook.com -all

A domain that never sends email

Publish this on parked domains and subdomains that send no mail, so nobody can pass SPF as them.

v=spf1 -all

Check SPF from the command line

dig +short TXT example.com | grep spf1
nslookup -type=TXT example.com

# Follow an include to count its lookups too
dig +short TXT _spf.google.com

Frequently asked questions

How many DNS lookups can an SPF record have?

Ten. RFC 7208 limits SPF evaluation to 10 mechanisms that need a DNS query (include, a, mx, ptr, exists and the redirect modifier), counted across every nested include. Exceeding it returns permerror. There is also a limit of two lookups that return no answer (void lookups).

Does SPF protect the From address people see?

No. SPF validates the envelope sender (Return-Path). A message can pass SPF for one domain while showing another in the From header. DMARC closes that gap by requiring SPF or DKIM to pass for a domain that aligns with the From address.

Why does SPF fail for forwarded email?

When a mailbox forwards a message, it arrives from the forwarder's IP, which is not in your SPF record. Forwarders that use SRS rewrite the envelope sender to avoid this; otherwise DKIM, which survives forwarding, is what keeps DMARC passing.

Do I need SPF on subdomains?

SPF records are not inherited. Each subdomain that sends mail needs its own record, and subdomains that never send mail can publish v=spf1 -all.

How long does an SPF change take to work?

Receivers see the new record once the old one's TTL expires in their resolver cache, usually within minutes to an hour. Lower the TTL before planned changes.