Skip to content
IPeek

SPF Check

Validate your Sender Policy Framework record

Checking…

What is an SPF record?

SPF (Sender Policy Framework) tells receiving mail servers which hosts may send email for your domain. A broken SPF record — duplicated, too many DNS lookups, or missing an 'all' mechanism — causes legitimate mail to land in spam. IPeek finds your SPF record, parses every mechanism and flags the issues that hurt deliverability.

How an SPF record works

SPF lives as a TXT record on your root domain, beginning with v=spf1. When a server receives mail claiming to be from you, it looks up that record and checks whether the sending IP is authorized. A record like v=spf1 include:_spf.google.com ip4:198.51.100.10 -all means "allow Google's hosts and this one IP, reject everything else." Mechanisms are evaluated left to right; the first match wins. The trailing all mechanism is the catch-all that decides the default outcome for any host not explicitly listed.

Hardfail, softfail, and the 10-lookup limit

The all mechanism sets your policy: -all is a hardfail (reject unlisted senders), ~all is a softfail (accept but mark suspicious), and +all allows anyone — never use it. SPF also caps DNS-querying mechanisms (include, a, mx, ptr, exists, redirect) at 10 total lookups; exceed it and the result is permerror, treated as a failure. Nested includes count too, so adding several vendors quietly burns through the budget. IPeek counts every lookup and warns before you hit the ceiling.

How SPF fits with DKIM and DMARC

SPF alone is not enough. It authenticates the envelope sender (the return-path), not the visible From address users see, so spoofers can pass SPF while forging your brand. DMARC closes that gap by requiring alignment between the SPF domain and the From domain, and by pairing SPF with DKIM so either can authenticate a message. Treat SPF as one of three layers: SPF authorizes hosts, DKIM signs content, and DMARC ties them to your From domain and enforces policy.

Frequently asked questions

How many DNS lookups can an SPF record have?

SPF allows a maximum of 10 DNS-querying mechanisms per evaluation. The include, a, mx, ptr, exists, and redirect mechanisms each consume lookups, and nested includes count toward the same limit. Exceeding 10 produces a permerror, which receivers treat as an authentication failure. Flatten or consolidate includes to stay under the cap.

What's the difference between -all and ~all in SPF?

The difference is enforcement. -all is a hardfail telling receivers to reject mail from any host not listed in your record, while ~all is a softfail telling them to accept it but treat it as suspicious. Use ~all while testing, then move to -all once you've confirmed every legitimate sender is authorized. Avoid +all, which authorizes anyone.

Why is my email going to spam if I have an SPF record?

An SPF record alone doesn't guarantee inbox placement. Common causes include exceeding the 10-lookup limit (permerror), a missing or overly permissive all mechanism, a sending host that isn't actually authorized, or duplicate SPF records on the same domain. SPF also doesn't protect your visible From address — you need DKIM and DMARC alongside it for strong deliverability.

Can a domain have more than one SPF record?

No. A domain must publish exactly one SPF (v=spf1) TXT record. Two or more SPF records cause a permerror, and receivers may reject or fail authentication for your mail. If you need to authorize multiple senders, combine them into a single record using additional include or ip4/ip6 mechanisms rather than adding a second record.

Does SPF check the From address users see?

No. SPF authenticates the envelope sender (the return-path or MAIL FROM), not the From header your recipients actually see. This is why SPF alone can't stop spoofing of your brand. DMARC adds SPF alignment, requiring the SPF domain to match the visible From domain, which is what closes the gap between protocol-level checks and what users read.