Check and validate SPF records, prevent email spoofing, and generate custom SPF records for your domain
SPF (Sender Policy Framework) is an email authentication method that helps prevent email spoofing by specifying which mail servers are authorized to send email on behalf of your domain. It's a critical component of email security and deliverability.
SPF records are essential for email security and reputation because they:
A typical SPF record looks like this:
v=spf1 ip4:192.0.2.1 include:_spf.google.com mx -all
Breaking down the components:
+ (Pass): Explicitly authorizes the source. Usually omitted as it's the default.
- (Fail/Hard Fail): Rejects emails from unauthorized sources. Recommended for strict security (e.g., -all).
~ (Soft Fail): Accepts but marks as suspicious. Used during testing or transition periods (e.g., ~all).
? (Neutral): No policy specified. Not recommended as it provides no protection (e.g., ?all).
Check and validate SPF records in real-time with detailed analysis
Create custom SPF records with our easy-to-use generator tool
Identify issues like excessive DNS lookups and syntax errors
SPF (Sender Policy Framework) is an email authentication method that specifies which mail servers are authorized to send email on behalf of your domain. It's published as a DNS TXT record and helps prevent email spoofing by allowing receiving mail servers to verify that incoming mail from a domain comes from an authorized server.
Enter your domain name in the SPF checker tool above and click "Check SPF Record". We'll retrieve your DNS TXT records, identify your SPF record, parse all mechanisms and qualifiers, validate the syntax, check for common issues, and display detailed results including warnings about potential problems.
A typical SPF record looks like: v=spf1 ip4:192.0.2.0 include:_spf.google.com mx -all. It must start with v=spf1, list authorized sources (IP addresses, includes, etc.), and should end with an "all" mechanism defining how to handle unlisted sources. The recommended ending is -all for maximum security.
-all (hard fail) means reject emails from servers not listed in the SPF record. ~all (soft fail) means accept but mark as suspicious. ?all (neutral) means no policy. +all allows any server (not recommended). Most domains should use -all for strict enforcement or ~all during testing.
SPF records are limited to a maximum of 10 DNS lookups. This limit prevents excessive DNS queries. Mechanisms that count toward this limit include: include, a, mx, exists, and redirect. If your SPF record exceeds 10 lookups, validation will fail. Use direct IP addresses instead of mechanisms when possible to reduce lookups.
No, you can only have ONE SPF record per domain. Multiple SPF records will cause authentication failures. If you need to authorize multiple sources, combine them into a single SPF record using mechanisms like ip4, include, and mx. Use our SPF generator to create a comprehensive record.
Log into your DNS provider (where your domain is hosted), navigate to DNS management, add a new TXT record with hostname "@" or your domain name, and paste your SPF record as the value. Changes typically propagate within 24-48 hours. After adding, use our checker to verify it's working correctly.
The include mechanism references another domain's SPF record. For example, include:_spf.google.com authorizes Google's mail servers. This is useful for third-party email services. Each include counts as a DNS lookup, so use them carefully to stay within the 10 lookup limit.
Common reasons include: exceeding 10 DNS lookups, multiple SPF records, syntax errors, missing v=spf1 prefix, no "all" mechanism at the end, using deprecated ptr mechanism, or character limit exceeded. Use our checker to identify specific issues with your SPF record.
SPF specifies authorized mail servers, DKIM adds a digital signature to emails, and DMARC tells receiving servers how to handle authentication failures. All three work together: SPF and DKIM provide authentication methods, while DMARC provides policy and reporting. Implementing all three provides the best email security and deliverability.