Check your domain's SPF record
Instantly validate your SPF record, detect misconfigurations, and see exactly which mail servers are authorised to send email as your domain.
What is an SPF record?SPF (Sender Policy Framework) is a TXT record that lists the servers allowed to send email for your domain. Receiving servers compare the sending IP with this list. Gmail, Yahoo and Outlook.com expect it from every sender, and bulk senders must pass SPF or DKIM aligned with their From domain.
This checker reads the SPF record for the domain you enter, follows every include, redirect, a and mx mechanism, counts the DNS lookups, and shows the policy at the end of the record.
How to read the result
- Pass with -all (hard fail): only the listed servers may send. This is the strongest setting.
- Pass with ~all (soft fail): mail from other servers is accepted but marked. Most domains use this; it is fine while you confirm every sender is listed.
- Warning with ?all (neutral) or +all: the record gives no protection. +all lets any server on the internet send as you.
- Lookup count: SPF allows 10 DNS lookups. The check warns from 8 and shows an error above 10, because receivers then return permerror and SPF fails for every message.
- Multiple records: a domain may publish only one record that starts with v=spf1. Two records make SPF invalid.
What the check does not see
SPF is checked against the envelope sender (the Return-Path), not the From address people see. If your email platform uses its own bounce domain, your SPF record is not used for that mail. To see which domain is checked for a real message, send one to the free email test and read the headers.
Example
A typical SPF record for Google Workspace plus one sending service
v=spf1 include:_spf.google.com include:sendgrid.net ~all
One record, two includes, soft fail. Use the SPF generator to build yours from a list of providers.
Common problems and fixes
Too many DNS lookups (permerror)
More than 10 lookups. Remove includes you no longer use or flatten the record.
SPF soft fail (~all)
What ~all means and when to move to -all.
SPF check failed
A sending IP is not in the record.
SPF temperror
A DNS timeout while the receiver checked SPF.
Gmail 550 5.7.27
Gmail blocked a message because SPF did not pass.
Frequently asked questions
How many SPF records can a domain have?
One. If a domain publishes two TXT records that start with v=spf1, SPF returns permerror and fails. Merge all senders into a single record.
What is the SPF 10 lookup limit?
RFC 7208 allows at most 10 DNS lookups while a receiver evaluates SPF. include, a, mx, ptr, exists and redirect each count. ip4 and ip6 do not. Above 10, the result is permerror.
Should I use -all or ~all?
Use ~all while you confirm that every service that sends for you is listed. Move to -all when DMARC reports show no real mail failing SPF. With DMARC at p=reject, ~all and -all give the same protection for aligned mail.
Does SPF protect the From address people see?
Not on its own. SPF checks the envelope sender. DMARC is what ties SPF (or DKIM) to the visible From domain.
Why does SPF fail for forwarded email?
Forwarding servers resend the message from their own IP, which is not in your SPF record. DKIM survives forwarding, so set up DKIM as well.