Domain Health · SPF
SPF record checker
Checks the record, follows every include, counts DNS lookups against the limit of 10, and tells you exactly what to change.
What SPF does
SPF (Sender Policy Framework) is one TXT record on your domain that lists the servers allowed to send email using your domain in the envelope sender. Receiving servers compare the connecting server's IP address against that list.
v=spf1 include:_spf.google.com include:sendgrid.net ~all
Read left to right: "this is SPF version 1; Google Workspace's servers may send; SendGrid's servers may send; treat anything else as a soft fail."
The problems we see most
Too many DNS lookups
Each include, a, mx, ptr, exists and redirect costs one DNS lookup, and so does everything inside the records they include. The standard (RFC 7208) caps the total at 10. Above that, receivers return a permanent error and SPF fails for every message, even legitimate ones.
Fix: remove includes for tools you no longer send from; replace a and mx with the ip4:/ip6: ranges they point to; or move a bulk sender (newsletters, for example) to a subdomain like news.yourdomain.com with its own SPF record.
Two SPF records
Adding a second v=spf1 record when you sign up for a new service is the most common mistake. Two records are a permanent error. Merge them into one record with one v=spf1 and one all at the end.
Ending in +all or ?all
+all lets any server on the internet pass SPF as you. ?all says nothing about unlisted servers. Use ~all while you confirm every sender is listed, then -all if you want hard failures. With DMARC enforcing, ~all is a widely used and safe choice.
An include that no longer exists
When a provider retires an include hostname, the include returns nothing and SPF breaks. Check the provider's current documentation and update the include.
SPF alone isn't enough
SPF checks the envelope sender, not the "From" address people see. To stop spoofing of the visible address you also need DKIM and a DMARC policy, which ties both to the From domain.