Skip to main content
Get started

SPF checker and record builder

Look up the SPF record of any domain, see every include it follows and whether it stays within the 10 DNS lookups that receivers allow. Then build a clean record for the services that send your mail.

Build an SPF record
SPF checker

Check the SPF record of a domain

SPF record builder

Build an SPF record for your domain

Services that send mail for you
Your own servers

Your SPF record

v=spf1 mx ~all

14 charactersDirect lookups: 1 / 10

How to publish it

  1. Open the DNS zone of your domain at your DNS provider.
  2. Add a TXT record on the root of the domain (name @, or empty) and paste the record as its value.
  3. If a TXT record that starts with v=spf1 already exists, replace it. A domain may have only one.
  4. Wait for the TTL to pass, then check the result with the SPF checker above.
More about TXT records
Guide

How SPF works and how to read a record

SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send mail for your domain. A receiving server looks up the record for the domain in the envelope sender, compares the connecting IP address with it and decides to accept, flag or reject the message. Without SPF, anyone can send mail that appears to come from you. SPF is also one of the checks behind DMARC, which large mailbox providers now expect from every sender.

A record is a list of terms, read from left to right. The first term that matches the sending server decides the result.

TermMeaning
v=spf1Marks the record as SPF. It always comes first.
ip4:203.0.113.5, ip6:2001:db8::/32Allows an IP address or a range. Costs no DNS lookup.
include:_spf.google.comAlso allows everything the other domain's SPF record allows. Costs a lookup, plus the lookups inside it.
mx, aAllows the servers in your MX records, or the address your domain points to. One lookup each.
~allSoftfail: other senders are suspicious. Use -all to reject them.

The limit of 10 DNS lookups

Receivers stop at 10 DNS lookups per check. Every include, a, mx, ptr, exists and redirect counts, and so does every one inside the records you include. Go over 10 and the result is a permanent error (permerror), which many receivers treat like a failed check. A few mail services in one record can add up faster than you expect, so the checker above counts the full chain. More than 2 lookups that return nothing (void lookups) is also an error.

If you are over the limit, drop services you no longer send from, replace an include with the ip4 and ip6 ranges it contains, or send mail from a subdomain with its own record.

Common SPF mistakes

  • Two SPF records. A domain may have only one TXT record starting with v=spf1. Merge them into one.
  • +all or ?all. Both let anyone send as your domain. End the record with ~all or -all.
  • A typo in an include. An include that points to a name without an SPF record is a permanent error for the whole record.
  • Forgetting a sender. With -all, a newsletter tool or invoicing system that is not listed has its mail rejected. Start with ~all, review your DMARC reports, then tighten.

SPF is stored as a TXT record at the root of your domain. With DNSense you can edit it at any provider from one table, and keep a backup of the zone before you change it.

Questions

Frequently asked questions about SPF

An SPF record is a DNS TXT record that lists the mail servers and services allowed to send email for your domain. Receiving servers check it to decide whether a message really comes from you.

Enter your domain in the checker above. It reads the TXT record from DNS, follows every include, counts the DNS lookups and lists errors and warnings, with a fix for each.

SPF allows 10 DNS lookups per check, counting every include, a, mx, ptr, exists and redirect, also inside included records. Over 10, receivers return a permanent error and your mail can fail authentication.

The term ~all (softfail) tells receivers that other senders are suspicious but may still be accepted. The term -all (fail) tells them to reject mail from anyone not listed. Start with ~all and move to -all when every sender is listed.

No. Two TXT records starting with v=spf1 cause a permanent error. Combine all senders into a single record.

Create a TXT record on the root of your domain (name @) with the record as its value. Replace an existing SPF record instead of adding a second one. Changes show up after the TTL of the old record has passed.

Not fully. SPF checks the envelope sender, not the From address people see. Combine it with DKIM and a DMARC policy to protect the visible From address too.

No. The checker looks up public DNS records for the domain you enter and shows the result. The builder runs in your browser.