What is an SPF record?
SPF (Sender Policy Framework) is a TXT record in your domain's DNS that declares which servers may send email on behalf of that domain. For every incoming message, receiving mail servers check whether the sending IP address is listed in the SPF record of the sender domain. If it is not, the message is treated as suspicious and, depending on the policy, ends up in spam or is rejected.
Together with DKIM and DMARC, SPF is one of the three pillars of email authentication. Since 2024 Google and Yahoo require bulk senders to have SPF and DKIM in place and a DMARC record with at least p=none. Without SPF, newsletters, invoices and system emails increasingly land in spam.
How to read the result
The checker shows the record it found, splits it into mechanisms and evaluates three things: is the syntax valid, how many DNS lookups does the record cause once all includes are resolved, and how strict is the closing qualifier.
- v=spf1: version tag, must come first.
- include:domain: pulls in a provider's SPF record, e.g. _spf.google.com for Google Workspace or spf.protection.outlook.com for Microsoft 365. Each include costs one DNS lookup plus whatever lookups the included record causes itself.
- a and mx: allow the domain's A or MX servers. Each costs one lookup.
- ip4 and ip6: allow fixed addresses or networks. They cost no lookup and are therefore the cheapest option.
- -all: hard fail, every other sender is unauthorised. Recommended.
- ~all: soft fail, other senders are suspicious but usually accepted. A good intermediate step.
- ?all or +all: neutral or allow everything. Offers no protection.
The 10 lookup limit
RFC 7208 limits the number of DNS queries a receiving server may perform while evaluating an SPF record to ten. Mechanisms such as include, a, mx, ptr, exists and the redirect modifier count; ip4 and ip6 do not. If the limit is exceeded the receiver answers with permerror and treats the record as if it did not exist. That is exactly when mail lands in spam even though an SPF record is present.
The most common cause is sprawl: Google Workspace (three lookups), Microsoft 365 (two), a newsletter tool, a CRM, a ticket system and the old hosting provider nobody removed. The checker resolves every include recursively and shows which service consumes how many lookups so you can clean up precisely.
Common mistakes
These are the problems we see most often when checking client domains:
- Multiple SPF records: two TXT records starting with v=spf1 are a permanent error. Everything belongs in a single record.
- More than ten lookups: see above. Remove unused services or use ip4/ip6 instead of include.
- No all at the end: without -all or ~all the record has no effect.
- +all: allows every server in the world to send on behalf of the domain.
- The ptr mechanism: deprecated, slow and ignored by many receivers.
- Typos in includes: an include pointing to a domain without an SPF record is an error.
Examples for common providers
Google Workspace:
v=spf1 include:_spf.google.com -allMicrosoft 365
Microsoft 365 with additional newsletter sending via Brevo:
v=spf1 include:spf.protection.outlook.com include:spf.brevo.com -allMonitor SPF continuously
An SPF record changes whenever someone adds a service, switches hosting or a provider restructures its networks. A one-off check says nothing about next month. DomainWarn checks the SPF record of all client domains regularly, detects changes and alerts you when the lookup limit is exceeded or the closing qualifier is weakened.
Frequently asked questions
- How many lookups may an SPF record have?
- At most ten. include, a, mx, ptr, exists and redirect count, each including the lookups that included records cause themselves. ip4 and ip6 do not count.
- What is the difference between -all and ~all?
- -all (hard fail) tells receivers to reject unlisted senders. ~all (soft fail) only marks them as suspicious. For domains with a finished configuration -all is the recommendation; ~all suits the rollout phase.
- Is SPF enough on its own?
- No. SPF only protects the envelope sender and breaks on forwarding. A domain is only protected against spoofing once DKIM and a DMARC policy are in place as well.
- Why does my mail land in spam despite SPF?
- Often because of permerror caused by more than ten lookups or multiple records, because DKIM or DMARC is missing, or because the sending IP is not in the record. The checker shows the first two causes directly.