Check your SPF record
See which servers a domain approves to send email, and what happens to mail from anywhere else. We'll show you the record we found and what it means today.
Frequently asked questions
How to use SPF check?
Enter a domain or email address, like dmarced.eu, and run the check. We will go ahead and look for the domain's DNS servers to ask them directly for the freshest results. We then gather our findings and present them in plain language. If you want to also check your DMARC record, select the DMARC check under the field.
What will I see in my SPF check result?
After running our SPF check, you'll be presented with the following information:
- Effect – A summary how inbox providers are behaving based on your current SPF record.
- Findings – Everything we have to say about the current SPF record. What’s off, how inbox providers may behave encountering it, and why that matters.
- Observations – The SPF TXT record we received directly from the authoritative DNS server, including details like it's DNSSEC state.
What does a good SPF record look like?
One DNS TXT record at the root of your sending domain, listing every provider that is allowed to send mails on behalf of your domain, ending in a catch-all setting for everyone else:
v=spf1 include:_spf.example.com ~allThe v=spf1 prefix marks the record as an SPF record. Each include hands over the check to a sender or source you choose, e.g. mail host, newsletter, or invoicing system. Ask the provider in question about what include to use. ~all covers everyone else trying to send on behalf of your domain. Here, we ask inbox providers to mark such mail as suspicious.
What mechanisms are SPF records made of?
Following SPF, mail can be matched/identified using the following mechanisms:
| Mechanism | Description |
|---|---|
include | Matches mail that would pass a specified SPF record. This is how you cover a provider that sends on behalf of your domain – your mail host, newsletter tool, or invoicing system. |
a | Matches the servers the specified A/AAAA record points to. Useful when your web server runs an application that sends email on behalf of your domain. |
mx | Matches the servers that receive mail for the specified domain, which are often the ones you send from too. |
ip4 | Matches a specific IPv4 address or IPv4 CIDR range. |
ip6 | Matches a specific IPv6 address or IPv6 CIDR range. |
all | Matches everything you didn't list before it. It is recommended to include it to make it explicit what rule should apply to senders that have not been listed before. |
Having identified a sending source, we also need to qualify it's traffic (between pass and fail). We do this by putting a qualifier symbol in front of each mechanism (e.g. -all). Omit it and it will be interpreted as + (pass), which approves those senders to send on behalf of your domain. The others are ~ (softfail), - (fail), and ?(neutral). SPF records are usually configured as a "disallow list," using the '+' qualifier (or omitting the qualifier, defaulting to the same) for every mechanism, except for the catch-all, where either ~all or -all is used to tell inbox providers to not trust senders that are not listed.
Start monitoring your email traffic today!
Ready to gain full visibility into your email traffic? Sign up to start monitoring your emails and take control of your domain’s security today.