Prevent email delivery failures and spoofing risks by checking your SPF record for errors and misconfigurations in seconds.
Type example.com, we fetch the published SPF record from DNS in real time.
Syntax, duplicate records, the 10-DNS-lookup limit, terminal policy strength, and common misconfigurations.
Each finding is graded high, medium, or low, with a plain-English explanation of what to fix.
The record parses correctly, stays within the lookup limit, and ends with a sensible policy. You're good to send.
The record exists but has issues, too many lookups, a weak terminal policy, or deprecated mechanisms. Review the graded findings below the record.
No SPF is published, so any server can claim to send as your domain. Use the SPF Generator to build and publish one today.
SPF lets receiving servers verify that mail claiming to be from your domain comes from servers you authorized.
Gmail and Yahoo now require SPF or DKIM for all senders, and both for bulk senders. Missing SPF sends you to spam.
SPF evaluation stops after 10 DNS lookups and returns a permanent error. Too many includes silently break your authentication.
SPF is one leg of email authentication. Pair it with DKIM signing and a DMARC policy for full protection.
A TXT record starting with v=spf1 that lists every server authorized to send email for your domain, ending with a policy (like ~all or -all) for everything else.
SPF allows at most 10 DNS lookups per evaluation (includes, a, mx, exists, redirect all count). Past 10, receivers return a permerror and your SPF effectively fails. Flatten includes or remove unused vendors to get under the limit.
~all (softfail) asks receivers to accept but mark suspicious mail; -all (hardfail) asks them to reject it outright. Start with ~all, monitor with DMARC reports, then tighten to -all.
No, publishing more than one v=spf1 record is a permanent error and breaks authentication. Merge all mechanisms into a single record.
Strengthen your domain security with our free lookup tools.
SenderSignal monitors these signals continuously: 48 blacklists, SPF, DKIM, DMARC, TLS and more, with alerts in Slack, email and signed webhooks.