About this tool
SPF (Sender Policy Framework, RFC 7208) is a TXT record listing the servers allowed to send mail using your domain in the envelope sender (the "Return-Path"). Receivers check it for every incoming message.
This checker fetches the record, validates its syntax, follows every include: and redirect=, and counts the DNS lookups a receiver would need.
How to read the results
Mechanisms are checked left to right; the first match decides the result. Each can have a qualifier: + pass (default), - fail, ~ softfail, ? neutral.
ip4:/ip6:— addresses or ranges (no DNS lookup needed).include:— also allow whatever another domain's SPF allows (e.g. your e-mail provider).a,mx— allow the domain's own A/AAAA or MX hosts.all— matches everything; put it last to set the default for unlisted servers.
The 10-lookup limit: include, a, mx, ptr, exists and redirect each cost one DNS lookup, including those inside included records. Over 10, receivers return permerror and SPF fails. Void lookups (names that return nothing) are limited to 2.
Limitations
- The checker evaluates the published record; it does not test whether a specific server IP would pass. Terms that use macros (%{i}, %{s} …) depend on each message and are not expanded.
- SPF only checks the envelope sender, not the From address people see. DMARC is what connects SPF to the visible From domain.
- Forwarded mail usually fails SPF because the forwarding server is not in your record. That is expected; DKIM survives forwarding.
Frequently asked questions
Should I use ~all or -all?
Both are fine once your sender list is complete. Many deliverability guides now recommend ~all combined with a DMARC policy, because DMARC then makes the final decision and forwarded mail is handled more gracefully.
Can I have two SPF records?
No. Merge them into one record. Two records cause a permanent error and SPF fails for all your mail.
How do I fix "too many DNS lookups"?
Remove includes for services you no longer use, avoid ptr, replace a/mx with explicit ip4/ip6 ranges where they are stable, or send some mail from a subdomain with its own SPF record.
Does SPF stop spoofing on its own?
No. An attacker can use their own domain in the envelope sender while faking your address in the visible From line. DMARC closes that gap.
Where is the SPF record stored?
As a TXT record on the domain itself, starting with v=spf1.
What does ~all mean?
Softfail: mail from unlisted servers is suspicious but usually accepted.
What does -all mean?
Fail: unlisted servers are not allowed to send.
What is the SPF lookup limit?
10 DNS-querying terms, including those inside includes.