How to Check SPF Records
SPF (Sender Policy Framework) is an email authentication mechanism that lets domain owners publish a list of IP addresses and servers authorized to send email on their behalf. Checking a domain's SPF record is essential when troubleshooting email delivery issues, investigating suspicious messages, or verifying that your own domain's email authentication is correctly configured.
Method 1: Use a web-based DNS lookup tool
The simplest approach is to use IPLookupHub's DNS Lookup tool. Enter the domain name, select TXT as the record type, and look for the record that begins with v=spf1. That is the SPF record.
Method 2: Use dig on the command line
dig example.com TXTScan the output for the TXT record starting with v=spf1. A typical result looks like:
example.com. 300 IN TXT "v=spf1 include:_spf.google.com ~all"Method 3: Use nslookup
nslookup -type=TXT example.comUnderstanding SPF syntax
An SPF record is a single TXT string that starts with v=spf1 and contains one or more mechanisms:
| Mechanism | What it does | Example |
|---|---|---|
ip4 | Authorizes a specific IPv4 address or range | ip4:192.0.2.0/24 |
ip6 | Authorizes a specific IPv6 address or range | ip6:2001:db8::/32 |
include | References another domain's SPF record | include:_spf.google.com |
a | Authorizes the domain's A record IP | a |
mx | Authorizes the domain's MX server IPs | mx |
~all | Soft fail: accept but flag unauthorized | ~all |
-all | Hard fail: reject unauthorized senders | -all |
Common SPF mistakes
- Multiple SPF records: a domain must have exactly one SPF TXT record. Having two causes a permanent error.
- Exceeding the 10-lookup limit: each
include,a,mx,ptr,exists, andredirectcounts as a DNS lookup. More than 10 causes a permerror. - Using
+all: this authorizes every IP on the internet to send mail for the domain, which defeats the purpose of SPF entirely. - Forgetting third-party senders: if you use a marketing platform, helpdesk, or transactional email service, their sending IPs must be included in your SPF record.
Frequently asked questions
What is an SPF record?
An SPF record is a DNS TXT record that lists the IP addresses and servers authorized to send email on behalf of a domain. Receiving mail servers check SPF to help detect forged senders.
Where is the SPF record stored?
SPF records are stored as TXT records at the domain's root in DNS. There should be only one SPF TXT record per domain.
What does ~all vs -all mean in SPF?
~all (tilde) means soft fail — mail from unauthorized servers is accepted but flagged. -all (dash) means hard fail — unauthorized mail should be rejected. Most modern setups use ~all or -all.
What is the SPF 10-lookup limit?
SPF has a limit of 10 DNS lookups during evaluation. Each include, a, mx, ptr, exists, and redirect mechanism counts as a lookup. Exceeding this limit causes a permanent error (permerror).