Email DNS8 min read
How to Check an SPF Record
SPF is published as a TXT record and tells receiving mail systems which servers are allowed to send for a domain. A small DNS mistake can make legitimate messages fail authentication or make the policy ineffective.
Find the SPF TXT record
SPF usually lives at the domain used in the SMTP envelope-from address. Look for a TXT value beginning with v=spf1.
SPF lookupdig
dig example.com TXT +short
dig @1.1.1.1 example.com TXT +shortCheck for duplicate SPF policies
A domain should publish exactly one SPF policy. If two TXT records both start with v=spf1, SPF evaluation returns a permanent error.
Duplicate SPF checkdig
dig example.com TXT +short | grep 'v=spf1'Understand the ending mechanism
- -all asks receivers to fail mail that does not match authorised senders.
- ~all is a softfail and is often used during a transition.
- ?all is neutral and rarely adds useful protection.
- +all allows everything and is usually a security mistake.
Common SPF mistakes
Adding every provider without review
Too many include mechanisms can exceed the SPF ten-lookup limit.
Checking only the visible From domain
SPF validates the envelope-from domain, which may differ from the visible sender.
Publishing two SPF records
Merge authorised senders into one v=spf1 policy.
Ignoring DKIM and DMARC
SPF alone does not fully protect domain alignment or spoofing.