Skip to main content
PPenTesting.org

Check your SPF record and fix it in minutes

Enter your domain to see your SPF record, how many of the 10 allowed DNS lookups it uses, and whether it stops other servers sending as you. If something is wrong, you get the record to publish.

Reads public DNS records only, the same ones every mail server reads. We do not keep your domain or the results. Own a domain and want it left out? Publish a TXT record reading exclude at _pentesting-org.yourdomain.

How a receiving mail server checks your domainYour mail server sends a message. The receiving server looks up your public DNS records and asks: Is the sending server on the list? The message is then delivered, sent to spam or rejected.Your mail serversends as example.commessageReceiving serverSPF checkDNS lookupTXT at example.comv=spf1 include:… ~allInboxSpamRejectedIs the sending server on the list?
Every receiving server asks the same question of your public DNS. This check reads the same records.

What an SPF record says

An SPF record is a list of who may send email for your domain, followed by an instruction for everyone else. Each part has a job, and some parts cost a DNS lookup.

The parts of an SPF recordv=spf1 starts the record; include and ip4 list allowed senders; ~all says what to do with everything else.v=spf1This is an SPF recordinclude:_spf.google.comYour email provider’s servers (1 lookup)ip4:192.0.2.10One server by address (0 lookups)~allEverything else: mark as suspicious
Receivers may make at most 10 DNS lookups for one SPF record. Each include, a, mx, ptr and exists term counts, including the ones inside an include.

The four mistakes this check catches

  • No record. Anyone can send mail as you, and your own mail is more likely to land in spam.
  • Two records. Usually left behind when a new email service is added. Receivers then ignore SPF completely.
  • Too many lookups. Each new tool you connect (a CRM, a help desk, a newsletter service) adds an include. Past 10, SPF fails for all your mail.
  • A weak ending. “+all” lets any server pass; “?all” or no “all” at all does not stop other servers.

Questions

What is an SPF record?

A TXT record on your domain that starts with "v=spf1" and lists the servers allowed to send email as you. Receiving servers look it up for every message and use it to decide whether mail claiming to be from you is genuine.

What is the SPF 10-lookup limit?

RFC 7208 lets receivers make at most 10 DNS lookups while checking one SPF record. Every include, a, mx, ptr and exists term counts, and so do the ones inside each include. Go over 10 and SPF fails for every message, even ones from your real servers.

Should my record end in ~all or -all?

"~all" (soft fail) asks receivers to treat other senders as suspicious; "-all" (fail) asks them to reject. Both are fine once DMARC is enforcing. Use "~all" while you confirm every service that sends for you, then decide. Never use "+all" or "?all", which allow anyone.

Can I have two SPF records?

No. A domain must have exactly one SPF record. With two, receivers treat SPF as broken. Merge them into one: keep a single "v=spf1", combine the terms, and end with one "all".

Is SPF enough on its own?

No. SPF checks the hidden envelope sender, not the "From" address people see, and it breaks when mail is forwarded. DKIM and DMARC close those gaps, which is why Google requires all three from anyone sending more than 5,000 messages a day to Gmail.

More email checks

Email security checker (all checks) →DKIM checker →DMARC checker →

PenTesting.org is an independent editorial directory. We are not an accreditation body or association and are not affiliated with CREST, the NCSC, OWASP, PCI SSC, or ISO. Accreditations are reported from public sources, with the evidence linked on each listing.