📧 SPF · record inspector & builder

Check Sender Policy Framework records — prevent email spoofing
📧
Enter a domain, then click "Check SPF"
SPF records define which mail servers are authorized to send email for your domain.
🔐 SPF = Sender Policy Framework 📝 Format: v=spf1 ip4:192.0.2.0/24 include:_spf.example.com -all ⚡ Using Google DNS over HTTPS

🔧 SPF Record Generator

Build your SPF record step by step:

v=spf1 ip4:192.0.2.1 include:spf.protection.outlook.com -all

📊 DNS Lookup Limits

⚠️ Important: SPF records are limited to a maximum of 10 DNS lookups. Each include:, a:, mx:, and redirect= counts as one lookup.
MechanismLookups
ip4/ip60 (direct IP)
include:1 + lookups in included record
a:1-2 (A + AAAA)
mx:1-2 + MX lookups

📋 SPF Mechanism Reference

MechanismDescriptionExample
ip4:Matches specific IPv4 address or rangeip4:192.0.2.0/24
ip6:Matches IPv6 address or rangeip6:2001:db8::/32
a:Matches domain's A/AAAA recordsa:mail.example.com
mx:Matches domain's MX serversmx or mx:example.com
include:Includes another domain's SPFinclude:spf.protection.outlook.com
exists:Tests if domain existsexists:%{i}.spf.example.com
redirect=Redirects to another SPFredirect=_spf.example.com
exp=Explanation for failuresexp=explain._spf.example.com

⚡ Qualifiers

QualifierMeaningResult
+Pass (default)✅
-Fail (hard fail)❌
~SoftFail⚠️
?Neutral❓

✅ SPF Best Practices (2026)

  • 🔑 Use -all (hard fail) - Soft fails (~all) can be ignored by some receivers
  • 📊 Stay under 10 DNS lookups - Each include: counts against this limit
  • 🔄 Avoid PTR mechanism - Deprecated and unreliable
  • 📝 Only one SPF record per domain - Multiple records cause "permerror"
  • ⚡ Use ip4/ip6 instead of a/mx when possible - Saves DNS lookups
  • 📋 Keep record under 512 bytes - Avoid UDP packet fragmentation

🔧 Common Issues

🚫 Too many DNS lookups: If your SPF has more than 10 lookups, receivers will reject it with "permerror"
🔄 Recursive includes: An include loop (e.g., A includes B, B includes A) will hit the 10-lookup limit
📏 Void lookups: More than 2 void lookups (domains that don't exist) cause permerror
🔍
EasyDMARC SPF Tools

Check, generate & validate SPF

📊
DMARCIAN SPF Survey

Detailed SPF analysis

⚡
Kitterman SPF Validator

Classic SPF testing tool

📨
Mail Tester

Full email authentication check