United KingdomEnglishRussiaРусскийUkraineУкраїнськаSpainEspañolBrazilPortuguêsTurkeyTürkçeGermanyDeutschFranceFrançaisChina简体中文Saudi ArabiaالعربيةIsraelעברית
Log in Sign up
Log in Sign up
SPF check

Check the SPF record of a domain and build a correct one

SPF tells receiving servers which hosts may send mail for your domain. The check follows every include, counts DNS lookups and shows where the record breaks.

Your browser sends the query straight to Cloudflare DNS, with Google DNS as a fallback. Our server does not see it.

SPF record generator

Tick the services that send mail for your domain and add your own servers.

Mail services
Own servers

Put this TXT record on the domain root

v=spf1 ~all

A message passes the SPF check: the sending server is matched against the allowed list

How SPF works

A receiving server takes the domain from the envelope sender, reads its SPF record and checks whether the sending IP is on the list. Mechanisms ip4 and ip6 list addresses, include pulls in the record of a mail service, and the final all rule decides what happens to everyone else.

Each include, a, mx, ptr, exists and redirect costs one DNS lookup, and nested includes count too. Past 10 lookups the check stops with an error, and mail from the domain fails SPF even from allowed servers.

When you need it

  • Check the sender domain before a mail campaign
  • Find out why mail from a new service lands in spam
  • Clean up a record that grew past 10 lookups after you added services

Questions and answers

01How many SPF records can a domain have?

One. Two or more records starting with v=spf1 make the check fail, so merge them into a single record.

02~all or -all: which one to choose?

Use ~all while you connect services and read DMARC reports. Switch to -all once every sender is listed and the reports show no legitimate mail failing.

03What if the record goes over 10 lookups?

Remove services you no longer use, list your own servers with ip4 and ip6 instead of a and mx, and check whether a provider offers a shorter include.

04Does a domain that sends no mail need SPF?

Yes. The record v=spf1 -all tells receivers the domain never sends mail, so forgeries get rejected at once. Add DMARC with p=reject next to it.

05Does SPF check the From address?

No. SPF looks at the envelope domain, the Return-Path. DMARC protects the address the recipient sees: it requires the SPF or DKIM domain to match the domain in the From field.

Pricing Grab a free hour