SPF Record Check

SPF (Sender Policy Framework) is a TXT record that tells the world which servers are allowed to send email on behalf of a domain. A correctly configured SPF record is one of the cheapest, most effective anti-spoofing controls you can deploy. Use the form below to look up the SPF record for any domain and see what its policy is doing.

How SPF works

When a mail server receives a message, it can look at the envelope sender and ask DNS: “does this domain publish an SPF record, and does it include the IP address that just connected to me?” If the answer is no, the record's final mechanism decides what happens next — -all means reject, ~all means accept but mark suspicious, and ?all means neutral.

What a good SPF record looks like

• Starts with v=spf1.
• Lists every legitimate sending source with ip4:, ip6:, a:, mx:, or include: mechanisms.
• Ends with a clear policy: -all for strict enforcement, ~all as a common middle ground.
• Stays under the 10-DNS-lookup limit that SPF imposes on include: chains.

Common SPF mistakes

Two SPF records on the same domain (this is a violation of the spec and will cause both to be ignored). Missing include: for a mail vendor you use. A trailing +all, which authorizes the entire internet to send as your domain. Chains of nested includes that exceed the 10-lookup budget and cause soft failures for legitimate mail. This tool lets you spot all of these at a glance.