SPF Checker

SPF is one of three DNS-based checks, alongside DKIM and DMARC, that let a receiving mail server verify a message really came from where it claims to.

SPF (Sender Policy Framework)

A DNS TXT record listing which mail servers are allowed to send email claiming to be from this domain. A receiving server checks the sending server's IP against this list when a message arrives.

Qualifiers (-, ~, ?, +)

Each mechanism carries one: - (fail, reject), ~ (soft fail, mark as suspicious), ? (neutral, no real policy), or + (pass, explicitly allow - the default if none is written). The final "all" mechanism's qualifier is the domain's overall fallback policy for anyone not explicitly listed.

Mechanisms (ip4, a, mx, include, ...)

Each one names a set of allowed senders: a literal IP range, a domain's own A/MX records, or another domain's SPF record entirely (include) - common for outsourced email providers like Google Workspace or Mailchimp.

The 10-lookup limit

RFC 7208 caps SPF evaluation at 10 DNS lookups total (each include/a/mx/exists/redirect/ptr mechanism counts one). Exceed it and receiving servers are required to treat the whole record as a permanent error - SPF stops working entirely, silently.

Why this matters

Without SPF, anyone can send email that appears to come from your domain - a common tactic in phishing. A record with a strict (-all) fail policy is what actually lets receiving servers reject that mail.

SPF alone doesn't tell a receiving server what to actually do with mail that fails it - that's DMARC's job. See DMARC Checker.