When a weak or broken SPF record exists, email spoofing can be easily done. The free SPF checker only takes a few seconds and will let you know what receiving servers will see when they query your domain for an SPF record.
The short answer
- An SPF checker looks at the SPF TXT record that you have in your DNS.
- It verifies that the record is found and in the proper syntax.
- It keeps track of DNS queries and identifies and reports on duplicate DNS records.
- It displays the list of servers and services that are allowed to send mail for your domain.
Here is an introduction to SPF and how to perform an SPF look up. You will also be able to read each answer and correct the most common issues. A maintenance routine at the end will maintain a healthy record over time.
What an SPF Checker Does and Why It Matters
How Sender Policy Framework works
Sender Policy Framework is an email authentication standard as per RFC 7208. The domain owner puts a list of approved senders into a TXT record in the DNS. As the message arrives, the receiving server looks to see if the sender's IP address is in that list. This can lead to a pass, fail or in between.
Why it protects your domain
If you don't have SPF, anybody can send mail pretending to be from your domain. This makes it easy to be phished or impersonated. Authentication is also a factor in mailbox providers' choices of where to place messages, whether in the inbox or the spam folder. Google and Yahoo both insist on authentication of bulk email, so SPF is no longer a choice for serious email senders.
Not all spoofing attempts are preventable with SPF. Best used in conjunction with DKIM and DMARC.
How to Run a Free SPF Record Lookup
Step by step process
- Open a trusted tool, like MxToolbox SuperTool or EasyDMARC SPF checker.
- Enter your domain name without the "www" prefix.
- Begin the search, and wait for the report.
- Read the published record and warnings.
- If you have a problem with your DNS panel, correct it and check again.
Prepare before you test
List all systems which send email on your domain. These are often your primary email provider, and your newsletter service. Include your CRM and help desk, and any billing or transactional service. Lookups can only tell you what has been published. It will not provide any suggestion about what you missed out on.
Popular tools compared
| Tool | Best for | Worth knowing |
|---|---|---|
| MxToolbox SuperTool | Quick checks plus DNS and blacklist tests | Some advanced monitoring features need a paid plan |
| EasyDMARC SPF checker | Clear reports and guided fixes | Deeper features sit behind an account |
| dmarcian SPF survey | Seeing the full chain of includes | Output is more technical for beginners |
Understanding SPF Results
Pass and fail
If they are authorized, the sending IP is considered as a pass. A fail means it is not. A hard fail is from the ending -all, and is telling receivers to reject unlisted senders.
SoftFail and neutral
A SoftFail is from ~all. Receivers typically believe the message but have doubts. A neutral result is one that is neither all nor makes any claim. A large number of domains begin with ~all and then switch to -all after reports have been received that all the legitimate senders are covered.
Errors
If you see a temporary error, you are most likely experiencing a DNS timeout. A permanent error is when the record itself is broken. Common reasons are poor SQL syntax or duplicate records or excessive lookups.
Key mechanisms
- The "included" policy is that of another domain, like you use for emailing.
- ip4 and ip6 are used to grant permission to specific IP addresses or ranges.
- a and mx are the domain name servers that are authorized.
- redirect redirects the entire evaluation to another domain.
- exists is a custom DNS test, and is not commonly required.
- The standard is not recommended and should be avoided: ptr.
Common SPF Problems and Fixes
Multiple SPF records
Only one SPF record can be published in a domain. Under RFC 7208, there are two times of permanent error. Send all senders in a single TXT record starting with v=spf1.
The 10 lookup limit
The number of DNS look-ups during evaluation is limited to 10 for SPF. Counting: Each include, and each a and mx and redirect counts toward the limit. Also, include tags are counted. The standard also limits the number of checkouts for a void to 2. If you cross either of these thresholds, you will get an error that cannot be corrected.
Warning. Wait to see all the valid senders before switching to -all. A forgotten service will then be rejected for the mails.
Missing or outdated entries
- If there is no record, no one knows.
- Outdated includes for services that have been cancelled still authorize outside platforms.
- If a name is misspelled in the include chain, it stops the lookup chain.
- If a forwarding server is not listed in the SPF record, then a forwarded recipient might not pass the SPF check. This case is covered by DKIM.
Best Practices for a Healthy SPF Record
Pair SPF with DKIM and DMARC
DKIM signs the message as it is sent, allowing to check the message later. DMARC validates the SPF or DKIM matches the From domain that you are sending from and provides you with reports. The reports show unknown sources and sources that are failing. Turn on DMARC in monitoring mode, and adjust it according to the improvement of data.
Maintenance checklist
- Perform a look-up once a month.
- Recheck if you add or remove any email platform.
- Remove unused services from includes.
- Have one document that has a list of all approved senders.
- Review DMARC reports for unfamiliar sources.
- You will not exceed the 10 lookups limit and have extra space to spare.
The following are some key points to keep in mind regarding SPF. Make sure to test again with every new tool that sends e-mail.
Honest pros and cons of SPF
- The pros are that it's free, has great support, and will just have a direct connection to improved deliverability.
- Cons are the limit of lookups and the handling of forwarded mail. It also doesn't guarantee the identity of the From address alone.
Check a domain today for any problems it identifies and correct them. After each change repeat the test to keep your record accurate.
