Check SPF Records

SPF Record Lookup: See Which Servers May Send Mail for a Domain

Enter a domain and the tool fetches its SPF record straight from the domain's authoritative name server, so you see the live value and not a stale cached copy. The result shows the full record, its TTL and each mechanism on its own line.

What an SPF record is

SPF (Sender Policy Framework, RFC 7208) is a TXT record that lists the servers allowed to send mail for a domain. A typical record:

v=spf1 ip4:203.0.113.0/24 include:_spf.google.com include:sendgrid.net ~all

• v=spf1: marks the TXT record as SPF. It must come first.
• ip4: and ip6:: allow an address or a range.
• a and mx: allow the domain's own A/AAAA or MX hosts.
• include:: also allow whatever another domain's SPF record allows. This is how you authorize Google Workspace, Microsoft 365 or a newsletter service.
• all: matches everything else, and its qualifier sets the default. -all means fail, ~all means softfail (accept but mark as suspicious), ?all means neutral. Never use +all, which allows any server on the internet.

What SPF checks, and what it misses

The receiving server takes the domain from the envelope sender (the MAIL FROM address, shown as Return-Path in headers) and checks the connecting IP against that domain's SPF record. SPF doesn't look at the visible From: address your reader sees. A spammer can pass SPF with their own domain in the envelope and still put your domain in From:. DMARC closes that gap by requiring the SPF or DKIM domain to align with the From: domain, so publish all three: SPF, DKIM and DMARC.

Rules that trip people up

• Publish exactly one v=spf1 record per domain. Two records cause a permanent error, and receivers treat that as a failure. Merge them into one.
• Evaluating the record may take at most 10 DNS lookups. include, a, mx, ptr, exists and redirect each cost one, including those inside included records.
• Each subdomain that sends mail needs its own record. SPF doesn't inherit from the parent domain.

Next steps

This lookup shows the record as published. To test it against the rules above, including the lookup count, use the SPF Validator. For the mail servers that receive your domain's mail, use the MX Record Checker.