Spoofing gets easier
A missing or weak SPF record makes it simpler for attackers to send mail that looks like it came from your domain.
Free Email Tool
SPF Checker
SPF is the record that tells the world which servers are allowed to send email for your domain. Get it right and you stop others spoofing your name; get it wrong and your real mail can land in spam. This guide shows you what to look for — and a specialist will check it for you, free.
Information:
Automated checker coming soon
What this tool checks
What a healthy SPF record looks like.
An SPF check looks at the single TXT record that authorises your senders. These are the parts that matter most.
-
A valid SPF record exists
Your domain should publish exactly one SPF TXT record beginning with "v=spf1" — no more, no less.
-
The right senders are listed
Every service that sends mail for you — Microsoft 365, Google, your CRM, your invoicing tool — needs to be authorised.
-
Includes resolve correctly
Each "include:" pulls in another provider's SPF. They must all resolve, or legitimate mail can fail.
-
You are under the 10-lookup limit
SPF allows at most ten DNS lookups. Go over and SPF returns "permerror", and your authentication breaks.
-
The record ends correctly
A sensible ending — "~all" (soft fail) or "-all" (hard fail) — tells receivers what to do with everyone else.
-
No duplicate or conflicting records
More than one SPF record is invalid and causes receivers to ignore SPF altogether.
Why it matters
SPF is your first line against spoofing.
SPF is one of the three authentication records (with DKIM and DMARC) that prove your mail is really from you. When it is wrong, two expensive things happen.
Real mail goes to spam
If a legitimate sender is not authorised, receivers may treat your genuine mail as suspicious and bin it.
It quietly drifts
Add a new tool that sends mail and forget to update SPF, and a record that was fine last year starts failing today.
Common problems
The SPF mistakes we see most.
Almost every SPF problem falls into one of these. A check catches them before they cost you a delivered email.
-
Too many DNS lookups
Stacking includes pushes you past the 10-lookup limit, triggering a permerror that breaks SPF entirely.
-
Missing a legitimate sender
A new invoicing or marketing tool was never added, so its mail fails SPF and lands in spam.
-
More than one SPF record
Two "v=spf1" records on the same domain is invalid — receivers ignore SPF, and you lose the protection entirely.
-
Ending in "+all"
This authorises the entire internet to send as you — the opposite of what SPF is for.
Preview the checker
Check a domain's SPF record
This is a preview of the automated SPF checker we are building. It does not run a live lookup or store anything you type.
Coming soon
Automated checking is on its way. A human audit is available now.
We are building instant, automated checkers as part of our Email Operations Center roadmap. Until then, a specialist will run this check by hand as part of a free Email Audit — and explain what it means for your business in plain English, with no jargon and no obligation.
- A real specialist reviews your setup — not an automated guess.
- Plain-English findings and the next step that actually matters.
- Free, with no obligation — we work alongside your existing IT.
Questions
Answers, in plain English.
What is an SPF record, in plain English?
SPF (Sender Policy Framework) is a small public record on your domain that lists which mail servers are allowed to send email as you. Receiving mail systems check it to help decide whether a message is genuine or a forgery.
What is the SPF 10-lookup limit?
SPF allows a maximum of ten DNS lookups when it evaluates your record. Each "include:" and similar mechanism counts. Exceed it and SPF returns a permerror, which means your authentication effectively fails — a very common cause of deliverability problems.
Should my SPF record end in ~all or -all?
"~all" is a soft fail (treat unlisted senders with suspicion) and "-all" is a hard fail (reject them). "-all" is stronger, but only move to it once you are certain every legitimate sender is authorised — otherwise you can block your own mail. A specialist can stage this safely for you.
Can I have two SPF records?
No. A domain must publish exactly one SPF record. Two or more is invalid and causes receivers to ignore SPF altogether, removing the protection. If you need to authorise several providers, you combine them into a single record using includes.
Does this tool run a live SPF check?
Not yet — the automated checker is in development. This page explains the check and what good looks like, and the form is a preview that does not run a live lookup or store anything. For results today, request a free manual audit.
Will fixing SPF stop my email going to spam?
SPF is one important part of the answer, alongside DKIM, DMARC and your sender reputation. Often a deliverability problem is a combination of these. Our Email Deliverability service diagnoses the real cause and fixes it at the root.