SPF checker — validate your SPF record
Enter a domain. We show the record, the full include chain and the lookup count — the most common invisible cause of permerror.
What SPF is
SPF (Sender Policy Framework, RFC 7208) is a TXT record in a domain's DNS listing the servers allowed to send mail for that domain (envelope-from / Return-Path). The receiver compares the connecting IP against the list and returns pass, fail, softfail, neutral or an error. SPF alone does not protect the visible From header — DMARC does.
Common SPF mistakes
More than 10 DNS lookups. Every include, a, mx, ptr, exists and redirect is a lookup; past 10 the whole record is permerror — as if it did not exist. Typical for companies with Google Workspace + Microsoft + ESP + CRM. Fix: remove unused providers, replace include with ip4:, flatten.
Two SPF records. Permerror. Keep one, merge mechanisms.
+all. Anyone can send as you. Use -all (hard) or ~all (soft).
No all. A record without all forbids nothing.
Include of a domain without SPF. Void lookup — filters penalize it, Google counts them separately (limit 2).
What a correct record looks like
v=spf1 ip4:203.0.113.10 include:_spf.google.com include:spf.mtasv.net -all — own server by IP, Google Workspace and Postmark via include, hard -all. Three lookups. If you send from many systems, consider subdomains (news.company.com with its own SPF) to stay under the limit.
FAQ
Is SPF enough to stay out of spam?
No. Since 2024 Google and Yahoo require SPF or DKIM plus DMARC for bulk senders, and Microsoft rejects without DMARC since 2025. SPF also breaks on forwarding — DKIM matters more.
~all or -all?
-all if you are sure the record covers every source. ~all during migrations. With DMARC p=reject the difference is small — alignment is what counts.