How to Check SPF Records — Step-by-Step Guide (2026)

What Is an SPF Record?

An SPF (Sender Policy Framework) record is a DNS TXT record that lists the mail servers authorized to send email on behalf of your domain. When a mail server receives an email claiming to be from your domain, it looks up your SPF record to check whether the sending server is on the authorized list.

If the sending server is not listed, the receiving server can mark the message as suspicious, send it to spam, or reject it outright — depending on how the receiving server is configured.

How to Check an SPF Record

Method 1: Free SPF Checker Tool (Fastest)

Use our SPF Checker. Enter your domain and you'll immediately see:

• Whether an SPF record exists
• The full raw record
• DNS lookup count (must stay below 10)
• Include chain expansion
• Any syntax errors
• A plain-English explanation of what the policy means

Method 2: Command Line (dig)

dig TXT yourdomain.com

Look for a TXT record starting with v=spf1. If you have multiple TXT records, filter for SPF:

dig TXT yourdomain.com | grep spf

Method 3: Command Line (nslookup)

nslookup -type=TXT yourdomain.com

Method 4: PowerShell (Windows)

Resolve-DnsName -Name yourdomain.com -Type TXT | Where-Object {$_.Strings -like "*spf*"}

Reading an SPF Record

Here's a typical SPF record:

v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.5 ~all

Tag breakdown

SPF Qualifiers

The 10 DNS Lookup Limit

This is the most common SPF problem. The SPF specification (RFC 7208) allows a maximum of 10 DNS lookups when resolving an SPF record. Every include:, a:, mx:, ptr:, and exists: mechanism counts as a lookup.

If your record causes more than 10 lookups, the SPF check returns a PermError, which behaves like a fail.

Example problem:

v=spf1 include:google.com include:sendgrid.net include:mailchimp.com include:salesforce.com include:zendesk.com ~all

Each include: may trigger multiple sub-lookups inside the included record. Five include: statements can easily exceed 10 total lookups.

Solution: Use our SPF Flattener to resolve all includes into direct IP addresses, reducing lookup count to 1.

Common SPF Errors

Multiple SPF records

Only one SPF TXT record is allowed per domain. If you have two, both will be ignored and SPF will return PermError.

# WRONG — two SPF records
v=spf1 include:google.com ~all
v=spf1 include:sendgrid.net ~all

# CORRECT — one combined record
v=spf1 include:google.com include:sendgrid.net ~all

Using -all too aggressively

Starting with -all (hard fail) before you've confirmed all legitimate senders are in the record will cause delivery failures. Start with ~all (soft fail) while auditing.

Forgetting sending services

If you use a marketing platform (Mailchimp, HubSpot, Klaviyo) or transactional email service (SendGrid, Postmark, Mandrill), their sending servers must be authorized in your SPF record.

Overly broad IP ranges

Authorizing entire /16 IP ranges (ip4:203.0.0.0/16) when you only use one specific IP gives attackers a large attack surface. Use the smallest necessary IP blocks.

What Happens When SPF Fails?

When SPF fails, the outcome depends on:

1. Your SPF all qualifier — -all vs. ~all vs. ?all
2. The receiving server's policy — each mail server decides how to handle SPF failures
3. Your DMARC policy — DMARC can override SPF outcomes with a clear policy

Without DMARC, a SPF failure alone may not result in rejection. DMARC is required to enforce a consistent policy across receiving mail servers.

Related Tools

• SPF Checker — Check any domain's SPF record in real time
• SPF Generator — Build a valid SPF record from scratch
• SPF Flattener — Reduce DNS lookups by flattening includes
• SPF Record Explainer — Interactive SPF syntax guide
• DMARC Checker — Check the DMARC record that governs SPF outcomes