SPF Record Checker

What an SPF record does

SPF is a list of servers you have authorised to send mail on behalf of your domain, published as a TXT record in DNS. When a message reaches a receiving mail server, it checks the IP address it came from against your SPF record and decides whether that address is on the list.

Records need re-checking well after the initial setup, because they decay. You add another sending service and cross the lookup limit; a provider changes its IP ranges; someone publishes a second TXT record without noticing the first. In every one of those cases the DNS panel looks perfectly normal while validation on the receiving side fails.

What the checker shows

Alongside the record itself you get the expanded chain: every include points at another domain's SPF record, which may contain includes of its own, and all of it counts towards one shared limit. The lookup counter shows how many of the ten allowed you have already spent — the single most common cause of deliverability problems nobody can explain.

The trailing all mechanism is analysed separately. A record ending in +all authorises every server on the internet to send as your domain, which is worse than having no SPF at all: the record exists, and it permits everything.

Common mistakes

• Two v=spf1 records. Usually the result of adding SPF a second time without removing the first. The outcome is permerror and no working SPF at all.
• More than ten DNS lookups. Typically appears once a third or fourth sending service is connected.
• The ptr mechanism. Deprecated, slow, and ignored by some receivers.
• No all mechanism. Without a trailing term the record defaults to neutral and achieves very little.
• Includes for services you no longer use. They consume lookups and leave authorisation with someone who should not have it.

What a correct record looks like

For a domain that sends only through its own mail server:

v=spf1 mx -all

For Google Workspace plus a marketing platform:

v=spf1 include:_spf.google.com include:spf.example-esp.com ~all

The record is published as a TXT record on the root of the domain (name @). Subdomains do not inherit it automatically: if campaigns go out from mail.example.com, that name needs its own record.