What is SPF?

SPF (Sender Policy Framework) is a DNS-based email authentication method that lets domain owners specify which mail servers are allowed to send email on behalf of their domain. Receiving servers check the SPF record to verify that incoming mail from a domain comes from an authorized source.

Example

example.com. 300 IN TXT "v=spf1 include:_spf.google.com ~all"

This record authorizes Google's mail servers to send on behalf of example.com and soft-fails all other senders.

How SPF Works

include: — Authorizes another domain's SPF senders
a — Authorizes the domain's A record IP
mx — Authorizes the domain's MX server IPs
ip4: / ip6: — Authorizes specific IP addresses or ranges
~all — Soft fail for unauthorized senders (recommended)
-all — Hard fail for unauthorized senders (strictest)
?all — Neutral, no policy assertion

SPF Lookup Limit

SPF has a 10-lookup limit for DNS-querying mechanisms (include, a, mx, redirect, exists). Exceeding this limit causes SPF to return a permanent error.

How SPF works and how to read this check

SPF (Sender Policy Framework) is a DNS TXT record, starting with v=spf1, that lists which servers may send email for your domain. Receiving mail servers check it to decide whether a message is genuine. This tool fetches your SPF record from Google Public DNS and breaks it into its mechanisms. It lists the mechanisms but does not expand each include: or count DNS lookups.

The parts of a record

include:_spf.google.com or include:spf.protection.outlook.com authorise a provider's servers (Google Workspace, Microsoft 365 and so on).
ip4: and ip6: authorise specific addresses; a and mx authorise your own web or mail servers.
The final all says what to do with everything else: -all (reject), ~all (soft fail, treat as suspicious) or ?all (neutral).

Mistakes that break SPF

More than one SPF record. A domain must publish exactly one. Two records cause a permanent error. Merge them into one.
More than 10 DNS lookups. Each include, a, mx and exists counts. Going over the limit makes SPF fail.
A missing sender. A newsletter or invoicing tool that sends as your domain but is not listed will fail.

SPF alone does not protect your visible "From" address. Pair it with DKIM and a DMARC policy; our SPF setup guide and email deliverability guide cover the details.

SPF Record Checker