SPF Checker
Check a domain's SPF record: whether it exists, its all qualifier, how many DNS lookups it uses and what to fix. The same scan grades DKIM, DMARC and the rest of the domain's email security.
Start a check
- DNS-Based Scan
- Non-Intrusive Analysis
What is an SPF record?
An SPF (Sender Policy Framework) record is a DNS TXT record, starting with v=spf1, that lists the servers allowed to send mail for a domain. Receiving servers compare the sending server's IP address with that list and get a result such as pass, fail or softfail (RFC 7208).
This SPF checker reads the record at the domain, checks it for the problems below and runs the full Email Security scan, so you also see DKIM, DMARC, MX, DNSSEC, MTA-STS, TLS-RPT and BIMI results. It reads public DNS only: it does not send mail or change records.
How the SPF check scores the record
The record starts at 100 and loses points for each problem. 80 or more is good, 50 to 79 is a warning and below 50 is bad. SPF carries 20 of the 100 points in the overall email security grade.
+all- Costs 50 points: any server on the internet passes SPF.
?all- Costs 30 points: neutral gives no protection.
~all- Costs 10 points: softfail is weaker than -all.
- More than 10 lookup terms
- Costs 20 points; 8 to 10 terms cost 10. The check counts include:, a:, mx:, ptr: and redirect= in the record itself and does not follow includes.
ptr- Costs 10 points: RFC 7208 says not to publish it.
- More than one SPF record
- The record scores 30, because receivers return permerror.
- Over the lookup limit but still graded good
- A record with -all and too many lookup terms can still score 80, because the score adds up separate deductions. Receivers return permerror for it, so fix the lookups first.
Common SPF errors and how to fix them
These are the problems this checker detects, with the change that fixes each one.
No SPF record
Without SPF, receivers get the result none and cannot tell which servers may send for the domain.
Fix: Publish one TXT record at the domain that lists your mail services and ends in ~all or -all. If the domain sends no mail, publish v=spf1 -all.
v=spf1 include:_spf.example.net ~all
More than one SPF record
A domain must not publish more than one SPF record; receivers return permerror and SPF fails (RFC 7208, sections 3.2 and 4.5). It often happens when a new mail service is set up with its own record.
Fix: Merge the mechanisms into a single record and delete the others.
v=spf1 include:_spf.example.net include:mail.example.org -all
Too many DNS lookups
include, a, mx, ptr, exists and redirect each cost a DNS lookup, and SPF allows 10 in total, counting the lookups inside included records. Over the limit, receivers return permerror (RFC 7208, section 4.6.4).
Fix: Remove services you no longer use, or move some senders to a subdomain with its own SPF record. Replacing includes with ip4 and ip6 ranges also works, but you must then update the record whenever the provider's ranges change.
+all lets anyone send
+all matches every server, so any host on the internet passes SPF for the domain.
Fix: Replace it with -all, or with ~all while you confirm every sender is listed.
?all gives no protection
?all returns neutral for unlisted servers: the domain makes no statement about them (RFC 7208, section 2.6.2).
Fix: Use -all, or ~all while you test.
~all instead of -all
~all (softfail) is a weak statement that unlisted servers are probably not authorized. Receivers should not reject mail on softfail alone, but may treat it with more suspicion (RFC 7208, section 8.5).
Fix: Once DMARC reports show every legitimate sender passing, change ~all to -all.
Deprecated ptr mechanism
RFC 7208 says ptr should not be published: it is slow, less reliable when DNS errors occur and puts a heavy load on the reverse DNS servers (section 5.5).
Fix: Replace ptr with ip4, ip6, a or include for the servers it was meant to cover.
SPF syntax at a glance
Mechanisms are evaluated from left to right, and the first one that matches decides the result.
v=spf1- The version. Every SPF record starts with it; TXT records that don't are ignored.
ip4: / ip6:- An IPv4 or IPv6 address or range, such as 192.0.2.0/24. No DNS lookup.
a / mx- The domain's own addresses, or the addresses of its MX hosts. One DNS lookup each.
include:- Checks another domain's SPF record, usually a mail provider's. One lookup, plus the lookups inside that record.
redirect=- Uses another domain's SPF record when nothing else matches. It is ignored when the record has an all mechanism.
-all / ~all / ?all / +all- The result for every other server: fail, softfail, neutral or pass. A mechanism without a qualifier means pass.
Example record
v=spf1 ip4:192.0.2.0/24 include:_spf.example.net -all
Sources
More email authentication tools
- DMARC CheckerCheck a domain's DMARC policy and reporting address.
- DKIM CheckerFind DKIM public keys under common selectors.
- BIMI CheckerCheck a BIMI record and its DMARC requirement.
- MTA-STS CheckerCheck the MTA-STS policy, its mode and TLS-RPT.
- SPF Record GeneratorBuild an SPF record and count its DNS lookups.
- DMARC Record GeneratorBuild a DMARC record with the right tags.
- Email Security AnalyzerGrade every email authentication record at once.
Beyond DNS records
These records stop other people sending mail as your exact domain. They do not stop phishing from lookalike domains or from compromised accounts, which send authenticated mail. Vigilbase OS connects the security tools you already pay for, including Microsoft 365, Google Workspace, Proofpoint and Mimecast. The Vigil agent investigates high-severity incidents and Vigilbase analysts handle exceptions.
Questions
SPF checker FAQ
What does an SPF checker do?
It looks up the TXT record starting with v=spf1 at a domain and checks it for problems that break or weaken SPF: a missing record, more than one record, too many DNS lookups, a permissive all qualifier and the deprecated ptr mechanism. This one also runs the full email security scan.Email Security AnalyzerCompare the public security checks
How many DNS lookups does SPF allow?
Ten. include, a, mx, ptr, exists and redirect each count, including the ones inside included records; ip4, ip6 and all do not. Above 10, receivers must return permerror and SPF fails (RFC 7208, section 4.6.4).Remove services you no longer use, or move some senders to a subdomain with its own SPF record. Replacing includes with the provider's ip4 and ip6 ranges also works, but you then have to update the record whenever those ranges change.About email authentication
Should an SPF record end in -all or ~all?
-all tells receivers that unlisted servers are not authorized; ~all says they probably are not, and receivers should not reject on that alone (RFC 7208, section 8.5). Start with ~all while you confirm every service that sends for you, then move to -all.For DMARC, fail and softfail both count as SPF not passing, so the qualifier matters most for receivers that act on SPF directly.About email authenticationEmail Security Analyzer
Can a domain have two SPF records?
No. If a lookup returns more than one TXT record starting with v=spf1, receivers return permerror (RFC 7208, section 4.5). Merge every mechanism into one record and delete the others.About email authentication
Is SPF enough to stop spoofing?
No. SPF checks the envelope sender (the Return-Path address), not the From address people see. DMARC ties SPF and DKIM results to the visible From domain and tells receivers what to do when both fail, so check DKIM and DMARC as well.About email authenticationEmail Security Analyzer
Can I check SPF through an API?
Yes. POST {"target":"example.com"} to https://vigilbase.com/api/v1/agent/tools/email-security/execute. The response holds the full email security result, with the SPF analysis under result.details.records.spf.Run a check through the public APIAPI authentication and rate limits
