How do I check my SPF record?

Enter your domain or any email address on it and click Check SPF. The tool shows the record, explains each part, counts the DNS lookups and lists any problems with a fix.

What is the SPF 10 DNS lookup limit?

SPF allows at most 10 DNS lookups. Each include, a, mx, ptr, exists and redirect counts, including the ones inside included records. If a record needs more than 10, SPF fails with a permanent error.

Should I use ~all or -all?

Both are safe. ~all (soft fail) marks unlisted servers as suspicious, and -all (hard fail) tells receivers to reject them. Many domains use ~all with a DMARC policy, which decides what happens to failing email.

Can a domain have two SPF records?

No. A domain must have only one SPF record. Two or more cause a permanent error, and SPF fails for every email. Merge all the services into one record.

Does SPF stop spoofing on its own?

Not fully. SPF checks the hidden return address, not the From address people see. To protect the visible From address, use SPF and DKIM together with a DMARC policy.

Where do I add an SPF record?

Add it at your DNS host, such as Cloudflare, GoDaddy or your web host. Create a TXT record on the root of the domain (often written as @) and paste the record that starts with v=spf1 as the value.

What does SPF permerror mean?

Permerror means the SPF record is broken, so receivers cannot use it. The usual causes are two SPF records on one domain, more than 10 DNS lookups, or a typing mistake in the record.

How long does an SPF record take to work?

Most changes work within a few minutes to an hour. Old answers can stay in caches until the record's TTL ends, and rarely it can take up to 48 hours.

What is SPF flattening?

SPF flattening replaces include mechanisms with the IP ranges they contain, which lowers the number of DNS lookups. It works, but the IPs change over time, so a flattened record must be updated regularly or email from that service will start failing.

SPF Checker - Free SPF Record Lookup and Validator

What is an SPF record?

An SPF (Sender Policy Framework) record is a TXT record in your DNS that lists every server allowed to send email for your domain. When an email arrives, the receiving server checks the sending server against this list. A record for a domain that uses Google Workspace can be as simple as v=spf1 include:_spf.google.com ~all.

What this SPF checker tests

One record only: two or more SPF records cause a permanent error.
The 10 DNS lookup limit: every include is followed and every lookup is counted, as receiving servers do.
Broken includes: included domains that have no SPF record.
The all mechanism: whether the record ends with -all, ~all, ?all or the dangerous +all.
Every part explained: each mechanism is shown with what it allows in plain words.

SPF mechanisms explained

ip4 and ip6

Allow a single IP address or a range, such as ip4:203.0.113.0/24. They do not use a DNS lookup.

include

Allow the servers of another service, such as include:_spf.google.com. Each include uses at least one lookup.

a and mx

Allow the IP of the domain's A record or of its mail servers. Each uses a DNS lookup.

all

Matches every other server and goes at the end: -all rejects them, ~all soft fails them and ?all is neutral.

How to fix common SPF errors

Multiple SPF records: combine all includes and IPs into one record that starts with v=spf1 and ends with one all.
Too many DNS lookups: remove services you no longer use, and replace includes with ip4 or ip6 ranges where the service allows it.
Missing service: add the include from each service that sends email for you, such as your newsletter or helpdesk tool.
+all or no all: end the record with ~all or -all so unknown servers are not trusted.

SPF record examples for popular email services

Each service that sends email for you gives you an include to add. Always copy the exact value from your provider's setup page, because some use different values per region.

Service	SPF include
Google Workspace	`include:_spf.google.com`
Microsoft 365	`include:spf.protection.outlook.com`
Zoho Mail	`include:zohomail.com`
SendGrid	`include:sendgrid.net`
Mailgun	`include:mailgun.org`
Amazon SES (custom MAIL FROM)	`include:amazonses.com`

To use several services, put all the includes in one record. For example, a domain that uses Google Workspace for staff email and SendGrid for website emails would publish:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

SPF results explained

Result	What it means
pass	The sending server is listed in the SPF record.
fail	The server is not listed and the record ends with -all.
softfail	The server is not listed and the record ends with ~all. Usually treated as suspicious, not rejected.
neutral	The record ends with ?all, so it makes no claim either way.
none	The domain has no SPF record.
permerror	The record is broken, for example two records or more than 10 lookups.
temperror	A temporary DNS problem. The receiver may try again later.

How to create or update an SPF record

List every service that sends email using your domain: your mailbox provider, website, newsletter, invoicing and helpdesk tools.
Collect the include or IP range each one gives you.
Build one record: start with v=spf1, add each include, and end with ~all.
At your DNS host, add or edit a single TXT record on the root of the domain with that value. Never add a second SPF record.
Check it here. You should see one record, fewer than 10 lookups and no errors.

SPF works best with DMARC. Check your DMARC record, and test your email content with the spam checker.

SPF Checker

Results for