SPF Record Checker: Test, Validate and Fix Your SPF DNS Record

An SPF record checker retrieves and evaluates the Sender Policy Framework policy published for a domain. SPF helps a receiving mail system determine whether sending infrastructure is authorized for the envelope-sender domain.

Check or generate an SPF record with DNSCheckers.com.

What Is an SPF Record?

SPF is published as a TXT record and normally begins with:

v=spf1

v=spf1 ip4:192.0.2.10 include:_spf.example.net -all

What an SPF Checker Tests

• Whether a policy exists
• Whether multiple SPF records exist
• Syntax
• Authorized IPv4 and IPv6 ranges
• Included providers
• DNS-dependent mechanisms
• The final all qualifier
• Potential lookup-limit problems

Common SPF Mechanisms

ip4 and ip6

Authorize addresses or networks.

a

Uses addresses returned by A or AAAA records.

mx

Uses addresses associated with MX hosts.

include

Evaluates another domain's SPF policy.

all

Matches senders not matched earlier and normally appears at the end.

SPF Qualifiers

• + means pass
• - means fail
• ~ means soft fail
• ? means neutral

How to Check SPF

1. Enter the envelope-sender domain or root domain used by the service.
2. Run the SPF lookup.
3. Confirm that one policy is returned.
4. Review every IP and include.
5. Check syntax and DNS dependencies.
6. Compare the policy with a complete inventory of legitimate senders.

Common SPF Errors

No SPF Record

The policy is missing or published at the wrong name.

Multiple SPF Records

Several v=spf1 records at one hostname can produce a permanent error.

Missing Sender

A CRM, website, helpdesk, newsletter, or cloud provider is not authorized.

Obsolete Sender

An old provider remains authorized after migration.

Too Many DNS Lookups

A complex combination of include, a, mx, exists, and redirect can exceed processing limits.

How to Combine Multiple Policies

Incorrect:

v=spf1 include:provider-a.example -all
v=spf1 include:provider-b.example -all

Combined:

v=spf1 include:provider-a.example include:provider-b.example -all

SPF and Forwarding

Traditional forwarding can break SPF because the forwarding server may not be authorized by the original sender's domain. DKIM and DMARC alignment provide additional evidence.

SPF vs DKIM vs DMARC

Deployment Checklist

1. Inventory every sender.
2. Identify fixed IPs and provider includes.
3. Create one policy.
4. Validate syntax.
5. Review DNS lookup count.
6. Publish at the correct hostname.
7. Test real messages.
8. Remove obsolete sources.
9. Review the record regularly.

Frequently Asked Questions

Where should SPF be published?

At the domain used for the envelope sender or return path, commonly the root domain for a simple configuration.

Can I publish two SPF records?

No. Combine legitimate sources into one SPF policy at the same hostname.

Does SPF stop all spoofing?

No. Use it with DKIM and DMARC.

Should I use -all or ~all?

Choose according to sender-inventory accuracy and enforcement goals. Test carefully before strict enforcement.

Conclusion

An SPF checker identifies missing policies, syntax errors, unauthorized senders, duplicate records, and excessive DNS dependencies.

Use the DNSCheckers.com SPF Checker and Generator to review or create a policy.