SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send email for a domain. Receiving mail servers compare the sending server with that list and use the result to accept, flag or reject the message.
A correct SPF record helps stop others from sending email that pretends to come from your domain, and helps your own messages reach the inbox. SPF is normally used together with DKIM and DMARC.
What you can find in a record.
| Term | Meaning |
|---|---|
| v=spf1 | Marks the start of an SPF record. It must come first. |
| ip4 / ip6 | Allows one IP address or a range of addresses. |
| a / mx | Allows the addresses of the domain, or of its mail servers. |
| include | Uses the SPF policy of another domain. Email providers usually ask you to add one. |
| all | Matches every other server. Its prefix sets the policy: - reject, ~ SoftFail, ? neutral, + allow. |
| redirect | Uses the policy of another domain instead of this one. |
The most common SPF problems.
Quick answers about SPF Check.
Receivers stop after 10 DNS lookups while evaluating SPF. If a record needs more, it is invalid and SPF fails. Remove unused includes, or replace some of them with ip4 and ip6 ranges.
"-all" tells receivers to reject email from servers that are not listed, and "~all" marks it as suspicious. Many domains start with "~all" while testing and move to "-all" once every legitimate sender is listed.
No. A domain must publish exactly one SPF record. If you have two, merge them into a single record.
No. SPF checks the sending server, not the address people see in the From field. Use it together with DKIM and DMARC.
Resolvers keep the old answer until its TTL runs out, and results here are cached briefly. Wait a few minutes and try again. You can also look at the raw records with DNS Lookup.