SPF Check
Validate SPF records and check DNS lookup limits for any domain.
What is SPF?
SPF is a rule that tells receiving mail servers which senders are allowed to send email on behalf of your domain. If it's wrong, your emails may go to spam or fail.
Important notes
- • SPF allows only ONE record per domain.
- • Do not add a second SPF record. Replace the old one.
- • SPF does not replace DKIM and DMARC.
- • DNS changes can take time to propagate.
SPF Record Lookup — Analyze Email Authorization
SPF lookup checks the v=spf1 TXT record in DNS for a domain. It reveals which IP addresses and mail servers are authorized to send email on behalf of that domain.
SPF records use mechanisms like ip4, ip6, include, a, and mx to define authorized senders. Our analyzer queries DNS directly, parses each mechanism, counts DNS lookups (SPF has a 10-lookup limit), and identifies issues like duplicate records, missing records, and exceeded lookup counts.
What is SPF?
SPF is a DNS TXT record that lists the mail servers authorized to send email for a domain. Receiving servers check this record during SMTP to verify the sender's IP is authorized.
When an email arrives, the receiving server performs an SPF lookup on the envelope sender's domain. If the sending IP matches an authorized mechanism, SPF passes. An SPF pass alone doesn't prevent spoofing of the From header — that's what DMARC alignment enforcement handles.
Understanding SPF Mechanisms: ip4, include, mx, a, all
SPF mechanisms: ip4/ip6 specify IP ranges, include delegates to another domain's SPF, a and mx authorize the domain's records, and ~all (softfail) or -all (hardfail) handle unauthorized senders.
The 'all' mechanism is always last and acts as the default for any IP not matched. '-all' (hardfail) rejects unauthorized senders. '~all' (softfail) marks them as suspicious. Most security guides recommend '-all' once your SPF record is stable. Using 'include' for every ESP consumes DNS lookups — stay under the 10-lookup limit.
SPF Fail, Softfail, Neutral: What They Mean for Email Delivery
SPF results: pass (authorized), fail (unauthorized, may be rejected), softfail (unauthorized, likely spam folder), neutral (no policy), none (no SPF record). Only pass and softfail typically result in message delivery.
Different receiving servers interpret SPF results differently. Gmail and Microsoft 365 generally deliver softfail (~all) messages but may apply spam scoring. A hard fail (-all) may result in rejection. If you've migrated to a new email provider but haven't updated SPF, existing emails from the old provider will fail.
Check SPF records, validate mechanisms, and detect common misconfigurations that cause email rejection.
Check SPF record nowUse Cases
SysAdmins use SPF lookup to verify that a new ESP has been correctly added to the SPF record before switching email sending. Security teams check SPF on phishing domains to understand their authorization posture. Email deliverability consultants use it to debug SPF failures causing email rejection.