--- title: "SPF record checker: validate SPF and count DNS lookups" description: "Check a domain’s SPF record for free. See every mechanism explained, the full include tree, DNS lookups against the limit of 10, void lookups and the fixes for each problem." url: "https://nextmail.sh/tools/spf-checker" --- Tools # SPF record checker Every include followed, every lookup counted. Enter a domain to read its SPF record from live DNS. Each part is explained in plain words, every include is followed to the end, and DNS lookups are counted against the limit of 10 that quietly breaks SPF. ## How to check an SPF record 1. 01 Enter the domain Type the domain after the @ in your From address, or the bounce domain your mail service uses. 2. 02 Read the verdict The record is read from live DNS, every include is followed, and each problem is explained with its fix. 3. 03 Fix it and check again Change the record at your DNS host, wait for its TTL to pass, then run the check again. ## What is an SPF record? SPF, short for Sender Policy Framework, is a TXT record on a domain that lists the servers allowed to send its mail. It starts with v=spf1, names those servers with mechanisms such as include and ip4, and usually ends with an all mechanism that says what to do with every other server. Receivers check SPF against the envelope sender, the address in the SMTP MAIL FROM command where bounces go, not the From address a person sees. Many mail services use a bounce domain of their own, so their mail passes SPF for their domain rather than yours. To evaluate a record, the receiver reads it left to right and stops at the first mechanism that matches the IP address of the connecting server. An include pulls in another domain’s record, and every term that needs a DNS query counts toward a limit of 10 for the whole check, including everything inside includes. SPF alone does not protect the From address. DMARC does that: it passes when SPF or DKIM passes for a domain that matches the From domain. That is why SPF, DKIM and DMARC are set up and checked together. SPF also breaks when mail is forwarded, because the forwarding server is not in your record. DKIM signatures survive forwarding, which is one more reason to set up both. ## SPF syntax: every mechanism, modifier and qualifier Mechanisms match sending servers, modifiers change how the record is read, and the qualifier in front of a mechanism decides the result when it matches. Lookup costs count toward the limit of 10. - **`v=spf1` Required, first** Marks the TXT record as SPF. A record that does not start with exactly v=spf1 is ignored. - **`all` 0 lookups** Matches every server. Put it last, because nothing after it is read. Its qualifier decides what happens to servers the record does not list. - **`include:` 1 lookup, plus everything inside** Checks the SPF record of another domain, usually your mail provider’s, and matches if that record passes. If the domain has no SPF record, the whole check fails with a permanent error. - **`a, a:/` 1 lookup** Matches the IP addresses in the A and AAAA records of the domain, or of the current domain when none is named. A suffix such as /24 widens it to a range. - **`mx, mx:` 1 lookup, up to 10 MX hosts** Matches the servers that receive mail for the domain. Each of its MX hosts is looked up, and more than 10 is a permanent error. - **`ptr, ptr:` 1 lookup, deprecated** Matches servers whose reverse DNS name ends in the domain. RFC 7208 says not to use it: it is slow, and some receivers skip it. - **`ip4:
/` 0 lookups** Matches one IPv4 address, or a range written with a prefix length. It costs no lookups, so it is the cheapest way to list servers with fixed addresses. - **`ip6:
/` 0 lookups** The same for IPv6 addresses and ranges. - **`exists:` 1 lookup** Matches when the domain has an A record. It is almost always built from macros, so a service can answer for each sending address. - **`redirect=` Modifier, 1 lookup** Hands the whole decision to another domain’s SPF record when nothing else matched. It is ignored when the record has an all mechanism. - **`exp=` Modifier, 0 lookups** Names a TXT record whose text receivers may quote when they reject mail. It is rarely used. - **`+` Pass, the default** The server is allowed. A mechanism with no qualifier passes, which is why all on its own, or +all, allows everyone. - **`-` Fail** The server is not allowed, and receivers may reject the message. -all is the strictest ending. - **`~` Soft fail** The server is probably not allowed. Receivers accept the message but may mark it. ~all is the usual ending while you are still finding every sender. - **`?` Neutral** The record makes no statement about the server, as if there were no SPF at all. ## Common SPF errors and how to fix them These are the problems that break SPF most often. Each one is flagged by the check above when it applies to your domain. ### Too many DNS lookups (permerror) SPF allows 10 DNS lookups for the whole check, counting every include, a, mx, ptr, exists and redirect, including those inside includes. Go over and receivers return a permanent error for every message, which DMARC treats as a fail. How to fix Remove includes for services you no longer use, replace a and mx with ip4 or ip6 where your servers have fixed addresses, or move a sending service to a subdomain with its own SPF record. Flattening includes into IP ranges also works, but providers change their ranges without notice, so a flattened record has to be updated automatically or it slowly breaks. ### Multiple SPF records A domain may publish exactly one TXT record starting with v=spf1. With two, receivers cannot choose and return a permanent error. It usually happens when a new service is added as a second record instead of being added to the first. How to fix Merge them: keep one v=spf1 at the start, put every include and ip from both records into it, and end with a single all. ### +all lets anyone send +all, or all with no qualifier, passes every server on the internet, so SPF stops proving anything and any server can pass it for your domain. How to fix End the record with ~all or -all instead. ### all or -all ~all asks receivers to accept but mark mail from unlisted servers, and -all asks them to reject it. With DMARC enforcing, the difference matters less, because DMARC decides what happens to mail that fails. How to fix Start with ~all while you find every service that sends as your domain, then move to -all once DMARC reports show nothing legitimate failing. ### An include with no SPF record If a domain named in include has no SPF record, because the service changed its setup or the name has a typo, the whole check fails with a permanent error, not only that include. How to fix Compare each include with the provider’s current documentation, and remove includes for services you no longer use. ### Void lookups A lookup that finds nothing, such as an a mechanism pointing at a host with no address, is a void lookup. RFC 7208 recommends failing SPF after two of them. How to fix Remove mechanisms that point at names with no records, and fix typos in host names. ### Record too long One DNS string holds at most 255 characters, so longer records are split into several quoted strings that receivers join without spaces. Past about 450 characters, answers may stop fitting in one packet. How to fix Split a long record into quoted strings at your DNS host, and shorten it by removing includes you no longer need. ### ptr is deprecated ptr asks for the reverse DNS of the sending server on every message. It is slow and unreliable, RFC 7208 discourages it, and some receivers skip it. How to fix Replace ptr with the ip4, ip6 or include your sending servers actually need. ### redirect next to all redirect= only applies when nothing in the record matched. If the record also ends with all, the all always matches first, so the redirect is never used. How to fix Use either redirect= or an all ending, not both. ### SPF fails after forwarding A forwarded message is sent on from the forwarding server’s own IP address, which is not in your record, so SPF fails at the final receiver. How to fix Sign your mail with DKIM, which survives forwarding, so DMARC can still pass. ## SPF includes for common senders Add the include for every service that sends mail as your domain, inside one record. Check your provider’s settings page too, because some give each account its own value. | Service | SPF include | Notes | | --- | --- | --- | | Google Workspace | `include:_spf.google.com` | Gmail on your own domain. | | Microsoft 365 | `include:spf.protection.outlook.com` | The commercial cloud. Government clouds use their own values. | | Amazon SES | `include:amazonses.com` | On your custom MAIL FROM subdomain, not the main domain. | | SendGrid | `include:sendgrid.net` | Only with automated security off. With it on, SendGrid’s CNAME records handle SPF. | | Mailgun | `include:mailgun.org` | On the sending domain you added, often a subdomain. EU accounts use include:eu.mailgun.org. | | Postmark | `include:spf.mtasv.net` | Usually not needed, because Postmark’s Return-Path domain carries SPF. | | Mailchimp | `include:servers.mcsv.net` | Mailchimp no longer asks for it, because its own return path passes SPF. | | Mailchimp Transactional | `include:spf.mandrillapp.com` | Mail sent through Mailchimp Transactional, formerly Mandrill. | | Zoho Mail | `include:zohomail.com` | The US data centre. Other regions have their own, such as zohomail.eu. | | Brevo | `include:spf.brevo.com` | Older setups used spf.sendinblue.com. | | Zendesk | `include:mail.zendesk.com` | Support replies sent from your own address. | | Salesforce | `include:_spf.salesforce.com` | Mail Salesforce sends as your domain. | | Fastmail | `include:spf.messagingengine.com` | Fastmail on your own domain. | | Proton Mail | `include:_spf.protonmail.ch` | Proton Mail on your own domain. | | iCloud Mail | `include:icloud.com` | A custom domain in iCloud+. | | Cloudflare Email Routing | `include:_spf.mx.cloudflare.net` | Lets mail forwarded by Email Routing pass SPF on the way through. | | Mailjet | `include:spf.mailjet.com` | The domain Mailjet sends from. | | HubSpot | `Shown in HubSpot` | Account-specific: HubSpot shows the exact include, with your account number, in its domain settings. | - **Service** Google Workspace - **SPF include** `include:_spf.google.com` - **Notes** Gmail on your own domain. - **Service** Microsoft 365 - **SPF include** `include:spf.protection.outlook.com` - **Notes** The commercial cloud. Government clouds use their own values. - **Service** Amazon SES - **SPF include** `include:amazonses.com` - **Notes** On your custom MAIL FROM subdomain, not the main domain. - **Service** SendGrid - **SPF include** `include:sendgrid.net` - **Notes** Only with automated security off. With it on, SendGrid’s CNAME records handle SPF. - **Service** Mailgun - **SPF include** `include:mailgun.org` - **Notes** On the sending domain you added, often a subdomain. EU accounts use include:eu.mailgun.org. - **Service** Postmark - **SPF include** `include:spf.mtasv.net` - **Notes** Usually not needed, because Postmark’s Return-Path domain carries SPF. - **Service** Mailchimp - **SPF include** `include:servers.mcsv.net` - **Notes** Mailchimp no longer asks for it, because its own return path passes SPF. - **Service** Mailchimp Transactional - **SPF include** `include:spf.mandrillapp.com` - **Notes** Mail sent through Mailchimp Transactional, formerly Mandrill. - **Service** Zoho Mail - **SPF include** `include:zohomail.com` - **Notes** The US data centre. Other regions have their own, such as zohomail.eu. - **Service** Brevo - **SPF include** `include:spf.brevo.com` - **Notes** Older setups used spf.sendinblue.com. - **Service** Zendesk - **SPF include** `include:mail.zendesk.com` - **Notes** Support replies sent from your own address. - **Service** Salesforce - **SPF include** `include:_spf.salesforce.com` - **Notes** Mail Salesforce sends as your domain. - **Service** Fastmail - **SPF include** `include:spf.messagingengine.com` - **Notes** Fastmail on your own domain. - **Service** Proton Mail - **SPF include** `include:_spf.protonmail.ch` - **Notes** Proton Mail on your own domain. - **Service** iCloud Mail - **SPF include** `include:icloud.com` - **Notes** A custom domain in iCloud+. - **Service** Cloudflare Email Routing - **SPF include** `include:_spf.mx.cloudflare.net` - **Notes** Lets mail forwarded by Email Routing pass SPF on the way through. - **Service** Mailjet - **SPF include** `include:spf.mailjet.com` - **Notes** The domain Mailjet sends from. - **Service** HubSpot - **SPF include** `Shown in HubSpot` - **Notes** Account-specific: HubSpot shows the exact include, with your account number, in its domain settings. ## SPF record examples Copy the one closest to your setup and swap in your own senders. Every example stays well inside the lookup limit. Google Workspace only ``` v=spf1 include:_spf.google.com ~all ``` One include, one lookup. ~all keeps unlisted mail flowing while you check DMARC reports. Microsoft 365 and Zendesk ``` v=spf1 include:spf.protection.outlook.com include:mail.zendesk.com -all ``` Two services, two lookups, and -all once both are known to pass. Your own server and Google Workspace ``` v=spf1 ip4:203.0.113.10 include:_spf.google.com -all ``` ip4 lists a server with a fixed address at no lookup cost, beside one include. A domain that sends no mail ``` v=spf1 -all ``` No server is allowed. Publish it on parked domains and subdomains that never send, so nobody can pass SPF as them. ## Questions this raises Let Nextmail write your SPF record Connect a domain and Nextmail writes its MX, SPF and DKIM records for you, so there is no record to merge or count by hand. [Set up a domain](https://nextmail.sh/signup.md) [DKIM record checker](https://nextmail.sh/tools/dkim-checker.md)[MX record lookup](https://nextmail.sh/tools/mx-lookup.md)[DMARC record generator](https://nextmail.sh/tools/dmarc.md)[Deliverability checker](https://nextmail.sh/tools/deliverability.md)[SPF, DKIM and DMARC explained](https://nextmail.sh/blog/spf-dkim-dmarc-explained.md)[All tools](https://nextmail.sh/tools.md)