Free tool
SPF Record Checker & Generator
Check any domain's SPF record in seconds, or build a new one with the free SPF record generator. We count every DNS lookup against the 10-lookup limit, flag syntax problems, and test DKIM, DMARC and MX at the same time.
Checks SPF, DKIM, DMARC and MX records live. Free, no sign-up.
Basics
What is an SPF record?
SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send email for your domain. Receiving mail servers look it up on every message.
Step 1
You send an email
Your mailbox provider's server connects to the recipient.
Step 2
Receiver looks up SPF
It fetches the TXT record that starts with v=spf1 on your domain.
Step 3
IP is compared
The sending IP is matched against your includes, ip4, a and mx entries.
Step 4
Pass or fail
A match passes. No match falls through to your ~all or -all rule.
Step 5
DMARC decides
The result feeds DMARC, which decides between inbox, spam and reject.
- DNS lookups allowed per SPF check
- 10
- SPF record allowed per domain
- 1
- characters per TXT string (longer records are split)
- 255
- daily emails to Gmail that make SPF + DKIM + DMARC mandatory
- 5,000+
Free generator
SPF record generator
Tick every service that sends email for your domain, add any of your own server IPs, and copy the record. Publish it as one TXT record at the root of your domain.
Add this TXT record
- Type
- TXT
- Host / Name
- @
- Value
- v=spf1 include:_spf.google.com ~all
Publish one SPF record per domain. If you already have one, merge the includes into it.
Already have an SPF record? Don't publish the generated one next to it. Add the new include to your existing record instead, as shown in how to merge multiple SPF records below.
Syntax
SPF record format and syntax, mechanism by mechanism
An SPF record is read left to right. The first mechanism that matches the sending IP decides the result.
| Mechanism | Example | What it does | Costs a lookup? |
|---|---|---|---|
| v=spf1 | v=spf1 | Version tag. Must come first. | No |
| include | include:_spf.google.com | Authorizes everything another domain's SPF authorizes. | Yes, plus its nested lookups |
| a | a | Authorizes the IPs in your domain's A record. | Yes |
| mx | mx | Authorizes the servers in your MX records. | Yes |
| ip4 / ip6 | ip4:203.0.113.10 | Authorizes a single IP or range. | No |
| exists | exists:%{i}.spf.example.com | Advanced macro-based check. | Yes |
| redirect | redirect=_spf.example.com | Uses another domain's SPF record instead. | Yes |
| ptr | ptr | Reverse-DNS match. Deprecated; avoid it. | Yes |
| all | ~all | Catch-all for every sender not matched above. | No |
Qualifiers
Each mechanism can be prefixed with a qualifier: + pass (the default), - fail, ~ soft fail and ? neutral. In practice you only set a qualifier on all. Never publish +all: it lets every server on the internet send as your domain.
| Qualifier | Result | What receivers do | Typical use |
|---|---|---|---|
+ | Pass | Accept: the sender is authorized. | Implied on every mechanism without a qualifier |
- | Fail | Treat as unauthorized; may reject. | -all |
~ | SoftFail | Accept but treat as suspicious. | ~all |
? | Neutral | No opinion either way. | Avoid; it protects nothing |
How to format an SPF record
- Publish it as a TXT record. The old dedicated SPF record type is obsolete.
- Start with
v=spf1, then list mechanisms separated by single spaces:ip4/ip6andincludeterms are the usual ones. - End with
~allor-all. Anything afterallis never evaluated. - Publish one record per host name. Use host
@for the root domain; a subdomain you send from needs its own record, because SPF isn't inherited. - Longer than 255 characters? Split the value into several quoted strings inside the same record. Receivers join them back together without spaces.
Copy & paste
SPF records for Google Workspace and Microsoft 365
Use the record for the provider that hosts your mailboxes. Outreach tools that connect to your Google or Microsoft mailbox send through that provider, so they don't need their own include.
Google Workspace
v=spf1 include:_spf.google.com ~allMicrosoft 365
v=spf1 include:spf.protection.outlook.com -allGoogle Workspace + a transactional provider (example: SendGrid)
v=spf1 include:_spf.google.com include:sendgrid.net ~allAdding a second sender? Edit the record, don't add another one.
Multiple senders
Multiple SPF records: how to add more than one sender
A domain can only have one SPF record, but that record can authorize as many services as you need. Adding multiple SPF records really means merging them into one.
Before: two records (SPF fails with permerror)
v=spf1 include:_spf.google.com ~all
v=spf1 include:sendgrid.net ~allAfter: one merged record
v=spf1 include:_spf.google.com include:sendgrid.net ~allHow to merge SPF records
- Find every TXT record on the domain that starts with v=spf1. The checker at the top of this page lists them.
- Keep a single
v=spf1at the start of one record. - Copy every include, ip4, ip6, a and mx term from the other records into it, and drop duplicates.
- Keep one
allrule at the end:~allunless you're sure every legitimate sender is listed. - Delete the other SPF records, then re-run the checker and confirm you're at 10 DNS lookups or fewer.
Too many senders for 10 lookups?
mail.yourdomain.com, with its own SPF record. Each host name gets its own record and its own 10-lookup budget.Troubleshooting
Common SPF errors and how to fix them
| What the checker says | What it means | How to fix it |
|---|---|---|
| No SPF record found | Receivers can't verify your senders, and Gmail and Yahoo may reject or junk your mail. | Publish one TXT record at your root domain using the template for your provider. |
| Multiple SPF records | SPF returns permerror, which counts as a failure. | Merge all includes into one v=spf1 record and delete the rest. |
| Over 10 DNS lookups | SPF returns permerror even for allowed servers. | Remove unused includes, replace a/mx with ip4 where the IPs are stable, or move bulk tools to a subdomain. |
| Ends in +all or ?all | Anyone can send as your domain. | End the record with ~all or -all. |
| No 'all' mechanism | Unmatched senders get a neutral result. | Add ~all at the end of the record. |
“No SPF record found” right after you added one?
- Check the host field. Most DNS providers want
@or a blank host; typing the full domain can createyourdomain.com.yourdomain.com. - Check the record type is TXT and the value starts with
v=spf1, with no extra characters before it. - Make sure you checked the domain you actually send from, not a different subdomain.
- Wait for the old record's TTL to expire, then check again.
SPF is only one of the three records receivers check. Run your domain through the DMARC checker next, or read the full email deliverability guide.
The full picture
SPF vs DKIM vs DMARC
| Record | What it proves | Where it lives | Required for bulk senders? |
|---|---|---|---|
| SPF | The sending server is allowed to send for the domain. | yourdomain.com TXT | Yes (Gmail, Yahoo, Outlook.com) |
| DKIM | The message was signed by the domain and not altered. | selector._domainkey TXT | Yes (Gmail, Yahoo, Outlook.com) |
| DMARC | SPF or DKIM aligns with the visible From domain, plus the policy for failures. | _dmarc TXT | Yes, p=none at minimum |
Don't want to touch DNS at all?
Get your DNS fix list
Tell us where to send it. We'll reply with mailbox, domain and DNS recommendations for your sending volume — or start right away and have mailboxes live in minutes.
Where should we send it?
Or see pricing →Frequently asked questions
How do I check my SPF record?
Enter your domain in the checker above. It reads your live TXT records, validates the SPF syntax and counts every DNS lookup. From a terminal you can also run "dig TXT yourdomain.com +short" or "nslookup -type=txt yourdomain.com" and look for the line starting with v=spf1.
Can a domain have two SPF records?
No. A domain must publish exactly one TXT record that starts with v=spf1. Two records make SPF return a permanent error (permerror), which counts as a failure. Merge all your includes into a single record.
How do I add multiple SPF records for different senders?
Put them all in one record. Start with v=spf1, add an include (or ip4) for each service, and end with one all rule, for example: v=spf1 include:_spf.google.com include:sendgrid.net ~all. Then delete any other v=spf1 record on the domain.
What does "no SPF record found" mean?
No TXT record starting with v=spf1 exists on the exact domain that was checked. Either it was never published, it was added to the wrong host (for example yourdomain.com.yourdomain.com), it was added as the wrong record type, or DNS hasn't updated yet. Publish one TXT record at host @ and check again.
What is the correct SPF record format?
One TXT record at your domain, starting with v=spf1, followed by space-separated mechanisms (include, ip4, ip6, a, mx) and ending with an all rule such as ~all or -all. Example: v=spf1 include:_spf.google.com ~all.
What is the SPF 10 DNS lookup limit?
RFC 7208 limits SPF evaluation to 10 DNS lookups. Every include, a, mx, ptr, exists and redirect counts, including the ones nested inside the records you include. Go over 10 and SPF fails with a permerror, even if the sending server is allowed.
Should I use ~all or -all?
~all (soft fail) marks unlisted senders as suspicious; -all (hard fail) tells receivers to reject them. Once DMARC is in place, DMARC decides what happens to failing mail, so ~all is a safe default. Use -all when you are sure every legitimate sender is listed.
How long does an SPF change take to work?
As long as your DNS record's TTL. Most providers use a TTL between a few minutes and one hour, so changes usually show up quickly, but some resolvers can cache old values for up to 48 hours.
Does SPF alone stop people spoofing my domain?
No. SPF checks the envelope sender (Return-Path), not the From address people see. DMARC is what ties SPF and DKIM results to the visible From domain and tells receivers to block spoofed mail.