SPF Record
Looking for a checker? Run our free SPF and DMARC check on any domain, no account and no sign-up. It reports every problem described on this page: whether exactly one SPF record exists, whether it parses, how many DNS lookups it costs against the limit of ten, and how it ends. The rest of this page explains what each result means.
What This Check Does
The SPF Record check verifies that a TXT record containing "v=spf1" exists for your domain root. SPF (Sender Policy Framework) is a fundamental email authentication mechanism that specifies which mail servers are authorized to send email on behalf of your domain.
DNS Spy queries your domain's TXT records and looks for a valid SPF record. If no SPF record is found, this check fails.
Why It Matters
Without an SPF record, any mail server in the world can send emails that claim to be from your domain, and receiving servers have no way to verify the claim. This makes your domain a prime target for phishing and spoofing attacks. Attackers can send fraudulent emails appearing to come from your domain to trick recipients into revealing sensitive information.
SPF is the first layer of email authentication, working alongside DKIM and DMARC to create a comprehensive email security framework. Without SPF, your DMARC policy cannot function effectively, and your email deliverability may suffer as anti-spam systems treat unauthenticated domains with suspicion.
NIST SP 800-81, Section 6, emphasizes the importance of email authentication, with SPF being a foundational requirement.
NIST SP 800-81 Compliance
Section 6 of the NIST Secure DNS Deployment Guide addresses email security and specifically recommends implementing SPF records. DNS Spy continuously monitors for the presence and validity of your SPF record, ensuring compliance with NIST email authentication guidelines.
Good vs. Bad Configuration
Bad Configuration
No TXT record containing 'v=spf1' exists for example.com. Any server can send email as your domain with no authentication check.
Good Configuration
example.com TXT "v=spf1 include:_spf.google.com include:sendgrid.net -all": authorizes Google and SendGrid to send email, and rejects (-all) all other sources.
How DNS Spy Monitors This
DNS Spy queries your domain's TXT records during each monitoring cycle, checking for a valid SPF record. If the SPF record is missing or removed, an alert is sent immediately. DNS Spy also monitors for changes to your SPF record, ensuring authorized senders remain properly configured.
Related
Check This on Your Own Domain
DNS Spy's free scan reads your live DNS, nameservers, SSL and email-authentication records and reports what it finds. No account required. Scan a domain →
If you want the same checks to keep running: DNS Spy re-resolves every monitored domain at least every ten minutes and alerts you when a record changes. See how monitoring works →
Check any domain's SPF and DMARC records now, free and without an account: SPF & DMARC Checker →
Frequently asked questions
What is an SPF record?
An SPF record is a DNS TXT record, starting with v=spf1, that lists the mail servers allowed to send email for your domain. Receiving servers check the sending IP against that list. Mail from a server that is not listed can be marked as spam or rejected, depending on your policy.
How do I check my domain's SPF record?
Look up the TXT records at your domain's root and find the one that begins with v=spf1. You can run dig TXT example.com, or use the free DNS Spy SPF and DMARC checker, which also counts DNS lookups against the limit of 10 and flags syntax problems.
Can a domain have more than one SPF record?
No. A domain must publish exactly one SPF record. If receiving servers find two TXT records starting with v=spf1, SPF returns a permanent error and your mail fails authentication. To authorize several senders, merge them into one record with multiple include mechanisms, such as include:_spf.google.com include:sendgrid.net.
What is the difference between ~all and -all in SPF?
-all is a hard fail, meaning mail from servers not in your SPF record should be rejected. ~all is a soft fail, meaning that mail is accepted but marked as suspicious. Many domains start with ~all while they confirm every sender is listed, then move to -all once nothing legitimate is failing.
