SPF is a DNS-based email authentication mechanism that lists which systems are allowed to send mail for a domain. A broken or incomplete SPF record can contribute to delivery problems, while an overly broad record can weaken protection.
Use the SPF Record Checker to inspect a domain’s published SPF record.
What an SPF record looks like
SPF is published as a TXT record and usually starts with v=spf1. The remaining mechanisms describe allowed senders and how other sources should be handled.
How to check SPF
- Enter the sending domain in the SPF Record Checker.
- Review the published TXT record.
- Check includes and IP mechanisms against the services you actually use.
- Look for multiple SPF records or syntax problems.
- Recheck after DNS changes have propagated.
Common SPF problems
- Publishing more than one SPF record for the same domain.
- Forgetting a legitimate sending provider.
- Keeping obsolete providers in the record.
- Using an incorrect qualifier at the end of the policy.
- Creating too many DNS lookups through nested includes.
Do not edit SPF blindly
Before removing an include or IP address, confirm whether marketing platforms, help desks, CRMs, transactional email providers or other systems still send mail for the domain.
SPF is only one part of email authentication
For a stronger email setup, review DKIM and DMARC too. Use the DKIM Record Checker and DMARC Record Checker.
Common SPF mechanisms
| Mechanism | Purpose |
|---|---|
ip4 / ip6 |
Authorizes specific sending IP addresses or ranges. |
include |
References another domain’s SPF policy, commonly used for email providers. |
a |
Authorizes addresses returned by the domain’s A or AAAA records. |
mx |
Authorizes addresses associated with the domain’s MX hosts. |
all |
Matches remaining senders and is normally placed at the end of the policy. |
Example SPF review workflow
If a company sends mail through Microsoft 365 plus a marketing platform, list both legitimate sources before editing the SPF record. Compare the existing include entries with the provider documentation, remove only confirmed obsolete services and test again after DNS propagation. Changing SPF without mapping every sender can cause legitimate mail to fail authentication.
SPF FAQ
Can a domain publish two SPF records?
A domain should publish one SPF policy. Multiple independent records beginning with v=spf1 can create a permanent error for receivers.
What is the SPF DNS lookup limit?
SPF evaluation has a limit on DNS-triggering mechanisms. Large chains of nested include statements can exceed that limit, so complex policies should be reviewed carefully.
Does SPF stop email spoofing by itself?
No. SPF is one authentication signal. DKIM and DMARC are commonly used alongside SPF to improve domain-level email protection and reporting.
Inspect your DNS record with the UptimeFixer SPF Record Checker.