What is an SPF record and how does it prevent email spoofing?

SPF (Sender Policy Framework) is a DNS TXT record that lists all authorized mail servers and IP addresses permitted to send emails on behalf of your domain name. Receiving mail transfer agents check this record against the sender IP. Without SPF, cybercriminals can easily impersonate your brand and dispatch fraudulent phishing campaigns.

What happens if my SPF record exceeds 10 DNS lookups?

RFC 7208 limits DNS-dependent terms to 10 along an SPF evaluation path. Exceeding that limit causes a PermError. This tool counts direct terms in the root SPF record only; included and redirected policies need a full evaluator to assess the complete path.

What is the difference between -all, ~all, and +all?

The qualifier preceding all dictates the receiving server action. -all (HardFail) strictly directs servers to reject unlisted IPs. ~all (SoftFail) marks unauthorized emails as suspicious or sends them to spam. +all (Allow-All) is extremely dangerous because it authorizes every computer on the internet to send as your domain.

Can I have more than one SPF TXT record for my domain?

No. Publishing more than one SPF TXT record on a single domain is an explicit violation of RFC 7208 Section 3.2. If mail servers encounter multiple SPF records, both records become immediately invalid (PermError). You must merge all authorized services into a single, unified v=spf1 record.

How do I combine Google Workspace and Microsoft 365 into one SPF record?

You can include multiple providers within the same SPF record by separating their include: tags with a single space. For example: v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all. Each include consumes one of your 10 allowed DNS lookups.

Email Authentication Suite

Free SPF Record Checker

Inspect your domain's Sender Policy Framework (SPF) record in seconds. Review policy qualifiers, direct DNS-dependent terms, and multiple record conflicts. This tool does not expand nested includes or certify the full RFC 7208 lookup limit.

Free Security Tool

SPF Record Checker

Inspect your domain's Sender Policy Framework (SPF) record. Find multiple records, review direct DNS-dependent mechanisms and policy qualifiers, and spot dangerous +all settings. Included and redirected policies are not expanded in this check.

The RFC 7208 10-Lookup Limit Rule

RFC 7208 limits DNS-dependent terms to 10 along an SPF evaluation path. This tool counts terms in the root record only. Nested include and redirect policies can add more, so this count cannot certify compliance with the limit.

Your SPF analysis will appear here

Enter your domain above to inspect its SPF TXT record, direct mechanisms, listed IP ranges, and policy qualifier.

What is an SPF Record and How Does It Work?

Sender Policy Framework (SPF) is an email authentication protocol established in RFC 7208. It allows domain owners to publish an authorized list of mail servers and IP addresses that are permitted to send emails carrying their domain name in the SMTP MAIL FROM envelope.

When a mail server receives an incoming email, it performs a DNS TXT lookup on the sender domain, extracts the SPF record, and checks whether the transmitting IP is authorized. If the sender IP matches, the email receives an spf=pass header. If it fails, the email is flagged or rejected based on your configured policy.

The RFC 7208 10-DNS Lookup Limit Explained

To protect DNS resolvers from denial-of-service amplification attacks, the SPF specification places a ceiling of 10 DNS-dependent terms along an evaluation path. The result above counts only terms in the root SPF record.

Count Toward 10 Limit (+1)

• include:domain.com
• a and a:domain.com
• mx and mx:domain.com
• redirect=domain.com
• exists:domain.com

Do NOT Count (0 Lookups)

• ip4:192.0.2.1/24 (Direct IP)
• ip6:2001:db8::/32 (Direct IPv6)
• all, ~all, -all
• v=spf1 version tag

If a full SPF evaluator finds too many lookups: Review nested includes and remove obsolete services first. Replacing an include with direct IP blocks may help, but those IPs must be kept current as your email provider changes them.

SPF Qualifier Cheat Sheet: -all vs ~all vs ?all vs +all

The suffix of your SPF record determines how receiving mail systems enforce unauthorized senders.

Qualifier	Policy Name	Receiver Action	Security Level
-all	HardFail	Rejects and bounces failing emails immediately.	Strict & Secure
~all	SoftFail	Accepts email but routes to spam/junk folder.	Recommended with DMARC
?all	Neutral	No policy assertion; accepted without flags.	Weak Protection
+all	Allow-All	Authorizes any computer on earth to send mail.	CRITICAL DANGER

How SPF, DKIM, and DMARC Work Together

SPF alone cannot prevent email spoofing completely because it only validates the hidden SMTP envelope address (Return-Path), not the visible "From:" header displayed in your email client.

1. SPF

Verifies sender server IP against the domain DNS record.

2. DKIM

Cryptographically signs email content to prevent tampering in transit.

3. DMARC

Enforces SPF/DKIM alignment with the visible From address and sets policies.

Related Security Tools

Explore our free webmaster security suite:

Full Platform

Automate Your Website Compliance

Beyond DNS security, does your website meet ADA & WCAG 2.2 accessibility standards? Find out with our AI-powered site audit.

Scan Your Website Free

Frequently Asked Questions About SPF Records

Everything you need to know about SPF syntax, lookup limits, and email spoofing defense.

SPF (Sender Policy Framework) is a standardized DNS TXT record that explicitly enumerates all mail servers and IP addresses permitted to send emails on behalf of your domain. When receiving servers (like Gmail, Microsoft Outlook, or Yahoo) receive an email claiming to come from your address, they verify whether the sender's IP matches your SPF list. Without an SPF record, anyone can forge your domain name to execute deceptive phishing attacks.