Validate your SPF (Sender Policy Framework) record. Detect syntax errors, check DNS lookup count limits, and identify configuration issues that could affect email deliverability.
SPF (Sender Policy Framework) is an email authentication protocol defined in RFC 7208. It allows domain owners to specify which mail servers are authorised to send email on behalf of their domain by publishing a TXT DNS record.
When a receiving mail server gets a message claiming to be from your domain, it checks the SPF record to verify the sending server is authorised. This prevents email spoofing and improves deliverability.
RFC 7208 limits SPF evaluation to 10 DNS lookups. Mechanisms that count toward this limit include include:, a, mx, ptr, and exists:. Exceeding 10 lookups results in a PermError, causing SPF to fail.
If you use many email services (Google Workspace, Mailchimp, Salesforce, HubSpot, etc.), each include: consumes lookups. Use our SPF Flattening Tool to consolidate includes into IP addresses.
An SPF (Sender Policy Framework) record is a DNS TXT record that lists the mail servers authorised to send email on behalf of your domain. Receiving mail servers check SPF to verify that incoming email from your domain originates from an authorised source. Without a valid SPF record, your emails are more likely to be marked as spam or rejected.
The ~all mechanism produces a SoftFail result for senders not listed in your SPF record. Mail that SoftFails is typically accepted but flagged or tagged as suspicious. It is useful during a transition period while you identify all legitimate sending sources. Once you are confident, switch to -all (HardFail) to reject unauthorised senders outright.
RFC 7208 caps SPF evaluation at 10 DNS lookups to prevent Denial-of-Service amplification attacks. Mechanisms that consume a lookup include include:, a, mx, ptr, and exists:. Exceeding 10 lookups causes a PermError, which most receivers treat as a fail. Use our SPF Flattening Tool to convert include: chains into direct IP ranges.
Without an SPF record the receiving server returns a None result, meaning SPF provides no authentication signal. Spammers and phishers can then freely spoof your domain in email headers. Modern mail providers increasingly treat domains with no SPF as suspicious. At minimum, publish v=spf1 -all for domains that never send email.