SPF Record Checker

What is an SPF record?

SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send email from your domain. Receivers check the envelope sender against your SPF record — if it doesn't match an authorised host, they can reject, quarantine, or junk the message.

How to read your SPF result

• include: delegates authorisation to another domain (e.g. _spf.google.com).
• ip4 / ip6: raw addresses allowed to send for the domain.
• ~all = softfail, -all = hardfail, ?all = neutral. Hardfail (-all) is strongest.

Common mistakes

• Multiple SPF records on the same domain (must be exactly one).
• More than 10 DNS lookups in the chain — receivers return PermError.
• Missing your ESP's include after switching providers.

Fix it once, monitor forever

Pair SPF with DKIM and a DMARC policy of quarantine or reject for full email authentication. Icemail configures all three when you connect a sending domain.

SPF checker FAQs

Can I have two SPF records?

No. A domain must publish exactly one SPF TXT record; two records make receivers return a permanent error and every sender fails authentication. When you add a provider, merge its include into the existing record rather than publishing a second one.

What happens when I exceed ten DNS lookups?

Receivers stop evaluating and return PermError, which DMARC treats as an SPF failure. Remove providers you no longer use, replace broad includes with specific ip4 ranges where possible, or flatten the record and monitor it for provider IP changes.

Should I use ~all or -all?

Start with ~all while you confirm every legitimate sender passes, then move to -all. Hardfail is stronger protection against spoofing, but only once your record is genuinely complete.

Does SPF alone protect my domain?

No. SPF breaks on forwarding and only checks the envelope sender. Pair it with DKIM signing and a DMARC policy so receivers have a reliable, aligned signal for every message you send.