SPF record checker

What the SPF record is, why it protects your domain from spoofing, what a correct and an incorrect one look like (with the ~all vs -all example) and how to fix it step by step. With a free, instant check of any domain.

FREE TOOL · NO SIGN-UP

Check your domain’s SPF now

Enter your domain and our email-authentication analyser reviews your SPF record together with DKIM, DMARC and MX in seconds: whether it exists, whether it is valid and whether its policy protects against spoofing. The analysis is instant and we don’t store your domain.

What is the SPF record?

SPF (Sender Policy Framework, defined in RFC 7208) is a TXT record you publish in your domain DNS to declare which mail servers are authorised to send messages on its behalf. When a receiving server gets an email claiming to come from your domain, it looks up your SPF record and checks whether the IP address that sent it is on the list of authorised senders. An SPF record always starts with v=spf1 and ends with an all mechanism that defines what to do with senders that are not listed.

Why it matters: it stops domain spoofing

Without SPF, an attacker can send emails that appear to come from your domain (fake invoices, CEO fraud, phishing against your customers) and many servers will accept them. With a well-configured SPF, those unauthorised sends fail authentication and are far more likely to be rejected or land in spam. SPF is, together with DKIM and DMARC, one of the three pillars of email authentication: it is the first thing providers like Google and Microsoft check, and its absence hurts your deliverability as well as leaving your brand exposed.

What a correct and an incorrect SPF look like

A correct record lists all your sending services and closes with a strict policy:

v=spf1 include:_spf.google.com include:sendgrid.net -all

The key difference is the ending. -all (hardfail) tells receivers to reject any sender not listed: it is the recommended policy once you have inventoried all your senders. ~all (softfail) asks them to accept it but mark it as suspicious: useful as an interim step while you confirm you are not forgetting a legitimate service. Avoid +all, which authorises anyone and completely disables the protection, and avoid staying on ~all forever. Having no SPF record, or having two SPF records on the same domain — which causes a PermError — are also incorrect configurations.

Common mistakes that break your SPF

Besides +all and publishing two records, the most common failure is exceeding the limit of 10 DNS lookups: each include, a, mx or redirect counts, and once you pass ten the SPF returns PermError and stops validating. Consolidate any unnecessary include. Remember too that SPF alone does not protect the visible address (the "From:" the recipient sees): it validates the envelope domain (Return-Path). That is why SPF must always be paired with DMARC, which aligns and protects the visible sender.

How to set up or fix your SPF step by step

1. Inventory every service that sends email as your domain: your mailbox provider (Google Workspace, Microsoft 365), your marketing platform, your CRM, your billing tool, and so on.
2. Create a single TXT record on the root domain that includes all of them, for example v=spf1 include:_spf.google.com include:sendgrid.net ~all.
3. Publish it in your DNS and wait for propagation (minutes to a few hours).
4. Verify that it resolves, that it does not exceed 10 lookups and that there are no duplicate records.
5. Once you are sure no sender is missing, harden the policy from ~all to -all.
You can check every step with our free analyser.

Frequently asked questions about SPF

How do I check my domain SPF record?

Enter your domain in our free analyser: we query your public DNS and instantly tell you whether an SPF record exists, whether it is valid and whether its policy protects against spoofing, along with DKIM, DMARC and MX.

What is the difference between ~all and -all in SPF?

-all (hardfail) asks servers to reject any sender not included in your SPF; it is the safest policy once you have listed all your services. ~all (softfail) asks them to accept it but mark it as suspicious, which is useful as an interim step. You should avoid +all, which authorises anyone.

Is SPF enough to protect me from spoofing?

No. SPF validates the technical envelope domain, but not the visible address the recipient sees. For real protection you must combine it with DKIM and, above all, with DMARC, which aligns and protects the visible sender of your emails.

Why does my SPF return PermError?

The most common cause is exceeding the limit of 10 DNS lookups (each include, a, mx or redirect counts) or publishing two SPF records on the same domain. Consolidate unnecessary includes and keep a single TXT record starting with v=spf1.

Sources and references

Updated: July 2026 · Informational content; not professional advice.

Keep learning

Monitor your email authentication continuously

Sign up free at OCIRIA Security and get alerts when your SPF, DKIM or DMARC changes or stops protecting your domain.

Sign up free Talk to us