SPF record checker
SPF is published as a TXT record beginning with v=spf1. It lists the systems allowed to send mail using the domain in the SMTP envelope.
Enter a root domain or subdomain—no protocol or path needed.
What to check in an SPF policy
A domain should publish no more than one SPF policy at a given name. Multiple v=spf1 records cause a permanent error rather than combining into one policy.
Mechanisms such as include, a, mx, exists, and redirect can trigger additional DNS lookups. SPF evaluation has a limit of ten lookup-causing terms, including lookups made by nested includes.
SPF is one part of email authentication
- Use DKIM to sign messages with a domain-controlled key.
- Use DMARC to require alignment with the visible From domain.
- Remove obsolete senders instead of keeping broad authorization indefinitely.
- Test every legitimate sending platform before changing the final all mechanism.
- Do not publish a second SPF record when adding a provider; merge the authorization carefully.
Quick answers
Frequently asked questions
What do -all, ~all, ?all, and +all mean?
-all is fail, ~all is softfail, ?all is neutral, and +all is pass. Publishing +all authorizes every sender and defeats the purpose of SPF.
Does SPF stop someone from spoofing the visible From address?
Not by itself. DMARC adds alignment checks between authenticated SPF or DKIM domains and the From domain users see.