v=spf1
Marks the line as an SPF record. It must come first.
Free SPF record lookup
SPF Checker
Type your business domain. We read its SPF record, count its DNS lookups, and give you the exact line to paste if something needs a fix.
- Free, no sign-up
- Nothing you type is stored
- Also checks the other records
What an SPF record does
Sender Policy Framework (SPF) is one text record in your domain's DNS. It lists the servers and email services allowed to send email that says it is from your domain. When a mailbox provider gets a message from you, it looks up this record and checks that the sending server is on the list.
The record always starts with v=spf1 and sits at the domain itself (the @ or blank name at most DNS hosts). Each service you send through, like your email service or a newsletter tool, adds its own include: part. The last part says what to do with mail from anyone not on the list.
An example SPF record for a business on Google Workspace
v=spf1 include:_spf.google.com ~all
include:_spf.google.com
Allows Google's sending servers. Microsoft 365 uses include:spf.protection.outlook.com instead.
~all
Mail from any other server should be treated as suspicious. -all asks for it to be refused.
Common SPF mistakes the checker finds
Two SPF records
A domain may have only one record that starts with v=spf1. With two, the SPF check fails for every email. Merge them into one line with every include: in it.
More than 10 DNS lookups
Each include:, a, mx, exists and redirect makes the receiver look up another record, and includes can hold more includes. Past 10, the check fails. Remove services you no longer use.
A missing service
If you send through a tool that is not in the record, its email fails SPF. Add the include: line that tool gives in its setup help.
Ending in +all
+all lets any server in the world send as your domain, which makes the record useless. End with ~all or -all.
Questions
How do I check my SPF record?
Type your domain in the box above and press Check it. The SPF tile shows the record we found, how many DNS lookups it makes, and what to change. Nothing you type is stored.
Should my SPF record end in ~all or -all?
Both are accepted. ~all (soft fail) asks receivers to treat other senders as suspicious, and -all (fail) asks them to refuse that mail. Many businesses start with ~all and move to -all once they are sure every service they use is listed.
Can I have more than one SPF record?
No. The SPF standard allows one record per domain. If you add a second service, add its include: to your existing line instead of making a new record.
Is SPF enough on its own?
Gmail and Yahoo ask every sender to set up SPF or DKIM, and bulk senders to set up both plus DMARC. SPF alone does not protect the From address people see, which is what DMARC adds.
Based on: IETF, “RFC 7208: Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1” (2014); Google, “Email sender guidelines” (2024); Yahoo, “Sender Best Practices” (2024)
Check the other records
Email gets through best with all three set up. The same check covers them, and each has its own page: DMARC Checker, DKIM Checker, or all three together in the SPF, DKIM and DMARC Checker.