Validate SPF Record

Validate SPF Record: Check Syntax, Lookups and Common Mistakes

Enter a domain and the validator fetches its SPF record, then runs a set of checks against RFC 7208. Each check shows Passed or Failed, so you can see which part of the record needs work.

What the validator checks

• SPF Record Published: the domain has a TXT record starting with v=spf1.
• Multiple SPF Records: exactly one SPF record exists. Two or more cause a permerror, and receivers treat that as an SPF failure.
• SPF Syntax: every term is a known mechanism or modifier with a valid qualifier.
• Deprecated Elements: flags ptr, which RFC 7208 says not to use because it is slow and unreliable.
• IP Addresses: ip4: and ip6: values are valid and public. A private range like 10.0.0.0/8 in SPF is almost always a copy-paste mistake.
• Includes: each include: domain publishes its own SPF record, and no includes loop back on each other.
• DNS Lookups: the record stays within the 10-lookup limit, counting nested includes.
• Void Lookups: no mechanism points at a name that returns nothing. RFC 7208 allows at most two such empty lookups before the check fails.
• Escaping: no stray quote characters left over from pasting into a DNS panel.
• All Mechanism: the record ends with an all mechanism and nothing follows it, since receivers ignore anything after all.

Fixing common failures

• Too many lookups: remove includes for services you no longer use, replace a and mx with explicit ip4: ranges where they're stable, or move bulk mail to a subdomain like news.example.com with its own record.
• Two records: merge them. v=spf1 include:_spf.google.com ~all plus v=spf1 include:sendgrid.net ~all becomes v=spf1 include:_spf.google.com include:sendgrid.net ~all.
• Include without a record: the provider changed its include name, or you have a typo. Check the provider's current setup docs.

Choosing the all qualifier

~all (softfail) is the common choice when you also publish DMARC, since DMARC decides what happens to failing mail. Use -all once you're sure every sender is listed, and always on domains that send no mail at all: v=spf1 -all. Never use +all, which authorizes every server on the internet.

To see the raw record and TTL straight from the authoritative server, use the SPF Record Lookup.