Use our SPF record lookup tool to quickly verify your domain's SPF records. Ensure proper email authentication and reduce spam or spoofing risks
An SPF lookup fetches a domain's Sender Policy Framework record: the TXT record, starting v=spf1, that lists which servers may send email for the domain. Receiving mail servers compare the sending server's IP against this list. This tool shows every SPF record published on the domain; the guide below explains how to read it and what to fix.
example.com. SPF is checked against the envelope sender (Return-Path) domain, which is usually, but not always, the domain in the From address.v=spf1.Take this example:
v=spf1 ip4:203.0.113.0/24 include:_spf.google.com include:sendgrid.net ~allIt says: mail may come from any address in 203.0.113.0/24, from any server Google lists for Google Workspace, or from SendGrid. Mail from anywhere else should be treated as suspicious (~all).
| Part | Meaning | Counts toward 10-lookup limit? |
|---|---|---|
v=spf1 | Marks the record as SPF. Must come first. | No |
ip4: / ip6: | An allowed IPv4 or IPv6 address or range | No |
a | The IPs in the domain's own A/AAAA records may send | Yes |
mx | The domain's MX servers may send | Yes |
include: | Also allow whatever another domain's SPF record allows (used for email providers) | Yes, plus every lookup inside it |
exists: | Pass if a DNS name exists; used by advanced setups | Yes |
ptr | Match on the sender's reverse DNS. Deprecated: slow and unreliable | Yes |
redirect= | Use another domain's SPF record instead of this one | Yes |
all | Matches everything not matched earlier, so it goes last | No |
Each mechanism can carry a qualifier: + pass (the default), - fail, ~ softfail, ? neutral. That is why the ending matters: -all asks receivers to reject unlisted senders, ~all asks them to accept but mark the message, and +all allows anyone and should never be used.
v=spf1, all the mechanisms, one all.include, a, mx, ptr, exists, redirect, including those nested inside includes). Over the limit, SPF fails. Remove services you no longer use, or replace includes with ip4/ip6 ranges where the provider publishes fixed ones.news.example.com needs its own record if it sends mail; it doesn't inherit one from example.com.| Service | Mechanism to add |
|---|---|
| Google Workspace | include:_spf.google.com |
| Microsoft 365 | include:spf.protection.outlook.com |
| Amazon SES | include:amazonses.com (on the custom MAIL FROM domain) |
| SendGrid | include:sendgrid.net |
Always confirm the current value in your provider's documentation; providers occasionally change them.
No. If a domain publishes more than one v=spf1 record, SPF evaluation ends in a permanent error and the check fails. Combine all mechanisms into a single record.
-all asks receivers to reject mail from servers not in the record; ~all asks them to accept it but treat it as suspicious. Many domains use ~all and let a DMARC policy decide what happens to failures. Use -all once you are sure every legitimate sender is listed.
Checking an SPF record may cause at most 10 DNS lookups. Every include, a, mx, ptr, exists and redirect counts, including the ones inside included records. Exceeding the limit makes SPF fail with a permanent error.
Put them all in the same record, for example v=spf1 include:_spf.google.com include:sendgrid.net ~all. Don't create a second SPF record for the new service.
Until resolvers' cached copies of the old TXT record expire, which depends on its TTL. You can watch the update with the DNS propagation checker using the TXT record type.