SPF Record Lookup Tool

What is an SPF Record?

SPF (Sender Policy Framework) is an email authentication method designed to detect and block email spoofing. An SPF record is a type of DNS TXT record that lists all the mail servers authorized to send email on behalf of a specific domain. Receiving mail servers can check the SPF record to verify that incoming mail from a domain is being sent from a listed, authorized server.

How SPF Works

When a mail server receives an email, it looks at the "envelope from" address. It then performs a DNS lookup to find the SPF record for that address's domain. The server compares the IP address of the sending mail server with the list of authorized IP addresses and servers in the SPF record. If the IP address matches, the message passes the SPF check.

SPF Record Syntax and Mechanisms

An SPF record always starts with v=spf1 and is followed by a series of mechanisms and qualifiers.

• a: Authorizes the server(s) listed in the domain's A records.
• mx: Authorizes the server(s) listed in the domain's MX records.
• ip4:192.168.0.1: Authorizes a specific IPv4 address.
• ip6:2001:db8::1: Authorizes a specific IPv6 address.
• include:otherdomain.com: Includes the SPF policy from another domain. This is how third-party services like Google Workspace or SendGrid are authorized.
• all: This mechanism always matches and is usually placed at the end of the record to define a default policy for all other senders.

SPF Qualifiers

Each mechanism can be prefixed with a qualifier to tell the receiving server how to treat a match.

• + Pass: The IP is authorized. This is the default qualifier and is usually omitted (e.g., a is the same as +a).
• - Fail: The IP is not authorized. Messages from such IPs should be rejected. (e.g., -all).
• ~ SoftFail: The IP is likely not authorized. Messages should be accepted but marked as suspicious or spam (e.g., ~all).
• ? Neutral: The IP is neither authorized nor unauthorized. The policy makes no statement (e.g., ?all).

Important Limitation: 10-DNS-Lookup Limit

An SPF record check must not result in more than 10 DNS lookups (for mechanisms like include, a, mx). Exceeding this limit will cause the SPF check to fail. Our tool helps you see your record, but a dedicated SPF validator is needed to check this limit.