How the SPF check works
Our server asks Cloudflare's public resolver for the domain's TXT records and picks the one that starts with v=spf1. It then looks up the SPF record of every domain named in an include or redirect, and of the domains those name, up to 20 records and six levels deep, the way a receiving mail server would. It never contacts the mail servers themselves.
Each term is read by the rules of RFC 7208. A receiver checks the address of the server that sent a message against the terms from left to right; the first that matches decides, and its qualifier says how: + pass, - fail, ~ soft fail, ? neutral. A term without a qualifier passes.
The terms include, a, mx, ptr, exists and redirect each cost one DNS lookup, and so do those inside every included record. RFC 7208 allows 10 per check: above that, the receiver stops and SPF fails for all of the domain's mail. ip4, ip6 and all cost nothing. In paste mode the record is read in your browser, so only its own lookups are counted.
SPF mechanisms and qualifiers
The terms an SPF record can hold, what each matches, and what it costs of the 10 lookups:
| Term | Matches when the sending server… | Lookups |
|---|---|---|
ip4 | has an IPv4 address in the address or range, such as ip4:192.0.2.0/24. | 0 |
ip6 | has an IPv6 address in the address or range, such as ip6:2001:db8::/32. | 0 |
a | has an address the domain's A or AAAA record names (this domain, or a:other.example). | 1 |
mx | is one of the domain's mail servers (its MX records). | 1 |
include | passes the SPF record of another domain, usually a mail service's. | 1 + its record's |
exists | makes a name exist that the receiver builds from the message; for special setups. | 1 |
ptr | has a reverse DNS name in the domain. Do not use: slow and unreliable. | 1 |
all | is anything at all. Always last: it sets what happens to every server not listed. | 0 |
redirect= | is allowed by another domain's record, used when nothing in this one matched. | 1 + its record's |
exp= | never: it only names a text that explains a rejection. | 0 |
Qualifiers
- + pass (the default when nothing is written): the server may send.
- - fail: the server may not send; receivers may refuse the mail.
- ~ soft fail: probably not allowed; the mail is accepted but treated as suspicious.
- ? neutral: no verdict, as if there were no SPF record.
Example
example.com publishes "v=spf1 ip4:192.0.2.10 mx include:spf.mailer.example ~all". The ip4 term costs no lookup, mx costs one, and the include costs one plus what the record of spf.mailer.example needs. That record is "v=spf1 ip4:198.51.100.0/24 include:spf2.mailer.example -all": one more lookup, and spf2.mailer.example lists only address ranges. That makes 3 of 10. A message from 192.0.2.10 passes at the first term; one from 203.0.113.5, which no term lists, reaches ~all and soft-fails, so it is usually accepted but treated as suspicious.
Questions
What is an SPF record and how do I check it?
SPF (Sender Policy Framework) is a TXT record in a domain's DNS that lists the servers allowed to send mail for it, starting with v=spf1. To check it, type the domain above: the checker finds the record, follows its includes and shows what each term means and what is wrong. To check a record before you publish it, switch to the pasted-record mode.
How do I fix "too many DNS lookups" in SPF?
SPF allows 10 DNS lookups per check, counting every include, a, mx, ptr, exists and redirect, also inside included records. Above 10 the record fails with a permanent error (permerror). Remove includes of services you no longer use, replace a and mx with the ip4 and ip6 addresses they stand for, and send bulk mail from a subdomain with its own SPF record. Flattening (copying a service's addresses into your record) works too, but goes stale when the service changes them.
Can a domain have two SPF records?
No. A domain may publish only one TXT record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for all mail. Merge them: keep one v=spf1, put the terms of both in it, and end with a single ~all or -all. Subdomains have records of their own and do not count.
What is the difference between ~all and -all?
-all (fail) tells receivers that mail from servers not listed is not allowed and may be refused. ~all (soft fail) says it is probably not allowed: it is usually accepted and marked as suspicious. With DMARC in place, receivers follow the DMARC policy either way, so ~all is the common choice; -all suits a domain that sends no mail at all. Avoid ?all and +all: they protect nothing.
Does SPF protect the From address people see?
Not on its own. SPF checks the domain of the bounce address (Return-Path), which people never see, so a forger can pass SPF with a domain of their own and still show yours in From. DMARC closes that gap: it requires SPF or DKIM to pass for the domain in the From line. Use the DMARC checker to see whether yours does.